Medusa operators blend in by using the remote management tools a victim already runs, so an intrusion can look like routine IT administration until the encryptor fires. This profile draws on the joint #StopRansomware advisory AA25-071A from the FBI, CISA and MS-ISAC, MITRE ATT&CK v20, Palo Alto Networks Unit 42 and Symantec. It covers names and aliases, targeting, techniques mapped to ATT&CK, how the group abuses accounts and credentials, and the controls and detections that interrupt its playbook. It is written for security operations, identity and infrastructure teams; attribution follows each source's wording and the page contains no leak-site material and names no individuals.
Key takeaways
- Medusa is not MedusaLocker. The FBI states the Medusa ransomware variant is unrelated to MedusaLocker and to the Medusa mobile malware, so check which family a threat report or IOC feed actually refers to before acting on it.
- Remote management software is the camouflage. AA25-071A lists AnyDesk, Atera, ConnectWise, eHorus, N-able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop, chosen to match tools already present in the victim network.
- Access is bought or exploited. Developers recruit initial access brokers with payments the advisory puts at USD 100 to USD 1 million, alongside phishing and exploitation of ScreenConnect CVE-2024-1709 and FortiClient EMS CVE-2023-48788.
- Valid admin credentials do the heavy lifting. Mimikatz against LSASS, a new domain account added to privileged groups, and PsExec running scripts as SYSTEM with those credentials carry the intrusion to encryption.
- Known controls break the chain. Allowlisting approved RMM tools, MFA on every remote path, patching KEV-listed edge flaws, alerting on new privileged accounts and keeping immutable offline backups address most of the documented behaviour.
Who they are (names and aliases)
The FBI first identified Medusa in June 2021. AA25-071A describes it as a ransomware-as-a-service operation that began as a closed group and later adopted an affiliate model, while the developers kept central control of ransom negotiation. MITRE ATT&CK tracks the operators as group G1051 and notes that some attacks may still be run directly by the core developers.
| Name or ID | Source | What it refers to |
|---|---|---|
| Medusa Group (G1051) | MITRE ATT&CK | The operators and affiliates; ATT&CK records the public names Spearwing and Medusa Actors |
| Medusa Ransomware (S1244) | MITRE ATT&CK | The encryptor, in use since at least 2021; encrypts with AES-256 and appends .medusa |
| gaze.exe | AA25-071A, Unit 42 | File name of the encryptor binary; Unit 42 notes the name Gaze also appears in the operators' scanner configuration |
| Spearwing | Symantec | Symantec's name for the group operating Medusa as a RaaS |
| Not Medusa: MedusaLocker | AA25-071A, Unit 42 | A separate ransomware family available since 2019 |
| Not Medusa: MEDUSA (S1220) | MITRE ATT&CK | An unrelated open-source Linux rootkit tied to espionage activity |
See the Threat Actor Groups Guide for how vendor naming schemes relate to each other.
Targeting and motivation
- Motivation: financial. ATT&CK maps the double extortion model to T1657 Financial Theft: data is taken before encryption and the victim is threatened with publication.
- Scale: AA25-071A says Medusa developers and affiliates had affected more than 300 victims as of February 2025. Symantec measured a 42 per cent rise in Medusa attacks from 2023 to 2024.
- Sectors: the advisory names medical, education, legal, insurance, technology and manufacturing. Unit 42 found high technology, education and manufacturing most affected, with healthcare close behind, and the United States hit most often.
- Selection: opportunistic. Victims are chosen by what access brokers can sell and which internet-facing systems are unpatched, not by sector strategy.
- Extortion mechanics: the ransom note asks victims to make contact within 48 hours through a Tor live chat or Tox; non-responders are telephoned or emailed. A leak site shows countdown timers, data is advertised for sale, and the advisory says a day can be added to the timer for USD 10,000 in cryptocurrency. Symantec reports demands between USD 100,000 and USD 15 million.
- Possible triple extortion: the FBI describes a victim who paid and was then contacted by a second actor claiming the negotiator had stolen the payment and demanding half again for a "true decryptor". Payment does not guarantee closure. See the Ransomware Payments and Sanctions Guide.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 entries recorded against G1051 or S1244, or techniques AA25-071A describes. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Resource development | T1650 Acquire Access | Initial access brokers recruited on criminal forums | Infostealer monitoring, credential reset on exposure, MFA |
| Initial access | T1566 Phishing; T1078 Valid Accounts | Phishing to steal credentials; legitimate local and domain accounts reused | Phishing-resistant MFA; sign-in risk policies |
| Initial access | T1190 Exploit Public-Facing Application | ScreenConnect CVE-2024-1709, FortiClient EMS CVE-2023-48788; Microsoft Exchange with web shells (Unit 42, Symantec) | Patch KEV-listed edge software first; remove management interfaces from the internet |
| Command and control | T1219 Remote Access Tools; T1572 Protocol Tunneling | RMM products listed above; Ligolo and Cloudflared tunnels; reverse shells over 443 | Allowlist one approved RMM; block unapproved tunnel software |
| Credential access | T1003.001 LSASS Memory; T1003.003 NTDS | Mimikatz against LSASS; ntds.dit access | Credential Guard, LSA protection, tiered admin model |
| Persistence | T1136.002 Domain Account | Domain account named "default" created and added to Domain Admins and Enterprise Admins | Alert on account creation and privileged group changes |
| Lateral movement | T1021.001 RDP; T1569.002 Service Execution; T1072 Software Deployment Tools | openrdp.bat enables RDP; PsExec runs scripts as SYSTEM; encryptor pushed by PsExec, PDQ Deploy or BigFix | Restrict RDP and admin shares; protect deployment consoles as tier 0 |
| Defence impairment | T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall; T1070.003 Clear Command History | Vulnerable or signed drivers kill EDR; firewall rules changed; PowerShell history deleted | Tamper protection; vulnerable driver blocklist; PowerShell logging off-host |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Rclone, sometimes renamed (Symantec saw lsp.exe) | Egress filtering; detect Rclone by hash and behaviour |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1489 Service Stop; T1529 System Shutdown/Reboot | Backup, database and security services stopped; shadow copies deleted; VMs shut down and encrypted | Immutable, offline backups with separate credentials |
The advisory lists the ports Medusa operators commonly scan: 21, 22, 23, 80, 115, 443, 1433, 3050, 3128, 3306 and 3389, using Advanced IP Scanner, SoftPerfect Network Scanner and built-in commands. Unit 42 describes a portable network scanner with a prepared configuration that deploys the encryptor over PsExec. See the Living off the Land Guide.
How they abuse identities and credentials
Human accounts
- Bought access: purchased credentials bypass every perimeter control that trusts a password. Infostealer logs are a common source for brokers, so a stolen browser credential store can become a Medusa intrusion weeks later. See the Infostealer Threat Guide.
- Phished passwords: the advisory names phishing as a primary method for stealing credentials. Its mitigations ask for MFA on webmail, VPNs and critical systems and for passwords that follow NIST guidance, long and without forced periodic changes.
Privileged and non-human accounts
- RMM agents as standing access: an RMM agent authenticates to its cloud console with its own machine credential and runs with SYSTEM rights. Whoever controls the console, or installs a second, unapproved RMM, controls every endpoint it reaches. Treat RMM tenants, their API keys and their admin accounts as privileged identities. See the RMM Tool Security Guide.
- Software deployment service accounts: PDQ Deploy and BigFix push software with domain credentials stored in the console. The encryptor was distributed this way, so the console and its service account need the same protection as a domain controller.
- Domain admin creation: once LSASS yields privileged credentials, a new domain account added to Domain Admins and Enterprise Admins gives durable access. Few legitimate processes create Enterprise Admins members, which makes this a high-fidelity alert. See the Credential Dumping Guide.
- Backup and hypervisor credentials: the encryptor stops backup services and the operators shut down virtual machines before encrypting them, which requires access to backup and hypervisor administration. See the Backup Identity Isolation Guide.
Notable incidents
| When | Event | What sources describe |
|---|---|---|
| June 2021 | First identified | FBI dates Medusa to June 2021; ATT&CK gives "since at least 2021" |
| February 2023 | Leak site launched | Unit 42 records the leak site announced on Telegram on 20 February 2023, marking a move to public extortion |
| 2023 to 2024 | Growth | Symantec measured a 42 per cent increase in attacks year on year, with early 2025 running at almost double early 2024 |
| January 2025 | US healthcare organisation | Symantec reports several hundred machines encrypted after four days of attacker presence |
| March 2025 | Joint advisory | FBI, CISA and MS-ISAC publish AA25-071A, recording more than 300 victims |
No NHI Mgmt Group breach page is attributed to Medusa. Remote access tooling abused the same way appears in many ransomware cases; see the Ransomware Groups Guide for comparisons with other active operations.
Detection and defence
Phased response for a defender
- First week, inventory remote access: list every RMM product, agent and console in the estate, including ones installed by managed service providers. Pick one approved tool and record its tenant, admin accounts and API keys.
- Patch the named flaws: confirm ScreenConnect, FortiClient EMS and Exchange are on fixed builds; both CVEs are in the CISA KEV catalogue. Test on a pilot server, keep the previous image for rollback, and rotate credentials stored on any host that ran a vulnerable build.
- Enforce MFA: on VPN, webmail, RMM consoles and deployment tools, phishing-resistant for administrators. See the Phishing-Resistant MFA Guide.
- Allowlist: run WDAC or AppLocker in audit mode for two to four weeks to find every RMM, tunnelling and file transfer binary, then enforce blocks on unapproved ones. Roll back by reverting the policy to audit. See the Application Allowlisting Guide.
- Harden credentials: enable Credential Guard and LSA protection, apply the Microsoft vulnerable driver blocklist, and separate tier 0 admin accounts from daily accounts.
- Protect recovery: keep backups encrypted, immutable and offline with credentials outside the production domain, and test restores, as the advisory recommends.
What to log and alert on
| Signal | Source | Why it matters |
|---|---|---|
| New RMM agent installation or first contact to an RMM vendor domain not on the approved list | EDR, DNS and proxy logs | Medusa installs RMM tools that match or add to the victim's own |
| Events 4720, 4728, 4756 (account created, added to global or universal security group) | Domain controller Security log | New domain account added to Domain Admins or Enterprise Admins |
| Registry change of fDenyTSConnections to 0; new inbound rule for TCP 3389 | Sysmon event 13, Windows Firewall event 2004 | Matches the openrdp.bat behaviour in the advisory |
| PsExec service creation (event 7045) and PDQ or BigFix jobs outside change windows | System log, deployment console audit | Encryptor distribution and remote script execution |
| certutil downloads, base64 encoded PowerShell, deletion of PSReadLine history | PowerShell event 4104, EDR | Ingress and defence impairment steps in AA25-071A |
| Rclone, Ligolo or cloudflared on servers; vssadmin deleting shadow copies; new kernel driver loads | EDR, Sysmon event 6 | Exfiltration, tunnelling and pre-encryption activity |
Metrics that show it is working
- Unapproved RMM count: distinct remote access products seen in EDR telemetry beyond the approved one; target zero.
- Edge patch latency: days from KEV listing to patch on internet-facing systems.
- Privileged group change triage time: minutes from a 4728 or 4756 event on a tier 0 group to analyst review.
- MFA coverage: share of remote access and RMM console accounts with enforced MFA.
- Restore success: share of quarterly restore tests completed within the recovery time objective.
Decision guidance
Small organisations that rely on a managed service provider should require the provider to name its RMM tool, enforce MFA on its console, and alert them to any other remote access software found; that one contract clause addresses the main Medusa route. Larger estates should treat RMM and software deployment consoles as tier 0 assets, monitor them through privileged session management, and test detections against the ATT&CK list in AA25-071A as the advisory recommends.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| MFA on remote and privileged access | AC-17, IA-2(1) | PR.AA-03 |
| Least privilege for admin accounts | AC-6(5) | PR.AA-05 |
| Allowlist remote access software | CM-7(5) | PR.PS-02 |
| Patch exploited flaws | SI-2 | ID.RA-01 |
| Monitoring and log review | SI-4, AU-6 | DE.CM-01, DE.CM-03 |
| Protected backups | CP-9 | PR.DS-11 |
Practitioner checklist
- Confirm threat feeds and detections target Medusa (G1051, S1244), not MedusaLocker.
- Approve one RMM product, block the rest with application control, and alert on new RMM installs.
- Patch ScreenConnect CVE-2024-1709, FortiClient EMS CVE-2023-48788 and Exchange, then rotate credentials on affected hosts.
- Enforce MFA on VPN, webmail, RMM and deployment consoles, phishing-resistant for administrators.
- Alert within minutes on new accounts in Domain Admins and Enterprise Admins.
- Protect PDQ, BigFix and similar consoles and their service accounts as tier 0.
- Enable Credential Guard, LSA protection and the vulnerable driver blocklist.
- Keep immutable, offline backups with separate credentials and test restores quarterly.
Standards and references
- FBI, CISA and MS-ISAC: #StopRansomware: Medusa Ransomware (AA25-071A)
- MITRE ATT&CK: Medusa Group (G1051)
- MITRE ATT&CK: Medusa Ransomware (S1244)
- CISA: Known Exploited Vulnerabilities Catalog
- Palo Alto Networks Unit 42: Medusa Ransomware Escalation and New Leak Site
- Symantec Threat Hunter Team: Medusa Ransomware Attacks
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Ransomware Groups Guide · RMM Tool Security Guide · ALPHV BlackCat Threat Actor Profile · Top 10 Ransomware Initial Access Vectors · Ransomware Prevention Guide