Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Medusa Group · Unknown · mitre-attack · refreshed 2026-10-06

Medusa Group

MITRE G1051 ↗

Medusa Group — ATT&CK roseMG

attack rose · 57 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2023-48788, CVE-2024-1709

Analyst brief

mitre-attack

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. ” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations.

The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

57 techniques · 13 of 15 tactics

  1. Resource development

    6 techniques

  2. Initial access

    1 technique

  3. Execution

    7 techniques

  4. Persistence

    3 techniques

  5. Privilege escalation

    1 technique

  6. Stealth

    7 techniques

  7. Defense impairment

    5 techniques

  8. Credential access

    2 techniques

  9. Discovery

    12 techniques

  10. Lateral movement

    2 techniques

  11. Command and control

    5 techniques

  12. Exfiltration

    1 technique

  13. Impact

    5 techniques

select a technique

Arsenal

1 malware · 4 tools
Malware
Malware · 1ATT&CK
Medusa RansomwareS1244 ↗
Tools
Tools · 4ATT&CK
certutilS0160 ↗
RcloneS1040 ↗
MimikatzS0002 ↗
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Medusa Group is cited as exploiting

none on KEV
  1. CVE-2023-487882026-10-17
    1. “Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2024-17092026-10-17
    1. “Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

5 sources
  1. 1.attack.mitre.org/groups/G1051
  2. 2.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  3. 3.intel471.com/blog/threat-hunting-case-study-medusa-ransomware
  4. 4.security.com/threat-intelligence/medusa-ransomware-attacks
  5. 5.securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ranso…

Track Medusa Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.