medusa

T1078Valid Accounts

Initial access through brute force or compromised credentials of legitimate RDP accounts.

T1133External Remote Services

Accesses the victim's network via an RDP service.

T1190Exploit Public-Facing Application

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1566Phishing

Initial access through phishing email attachments.

T1047Windows Management Instrumentation

Uses a series of Windows commands, such as bcdedit.exe and vssadmin.

T1059Command and Scripting Interpreter

Uses a series of Windows commands, such as bcdedit.exe and vssadmin.

T1059.001Command and Scripting Interpreter: PowerShell

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged PowerShell for execution and defense evasion.(Citation: Check Point Medusa Ransomware April 2025)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Intel471 Medusa Ransomware May 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1059.003Command and Scripting Interpreter: Windows Command Shell

[Medusa Group](https://attack.mitre.org/groups/G1051) has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1072Software Deployment Tools

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1106Native API

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Windows Native API functions to execute payloads.(Citation: Security Scorecard Medusa Ransomware January 2024)

T1559.001Inter-Process Communication: Component Object Model

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Component Object Model (COM) to bypass UAC.(Citation: Intel471 Medusa Ransomware May 2025)

T1569.002System Services: Service Execution

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [PsExec](https://attack.mitre.org/software/S0029) to execute scripts and commands within victim environments.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also used the Windows service RoboCopy to search and copy data for exfiltration.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1112Modify Registry

[Medusa Group](https://attack.mitre.org/groups/G1051) has modified Registry keys to elevate privileges, maintain persistence and allow remote access.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1136.002Create Account: Domain Account

[Medusa Group](https://attack.mitre.org/groups/G1051) has created a domain account within the victim environment.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1505.003Server Software Component: Web Shell

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized webshells to an exploited Microsoft Exchange Server.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1543.003Create or Modify System Process: Windows Service

[Medusa Group](https://attack.mitre.org/groups/G1051) has used vulnerable or signed drivers to modify security solutions on victim devices.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1543.003Create or Modify System Process: Windows Service

[Medusa Group](https://attack.mitre.org/groups/G1051) has used vulnerable or signed drivers to modify security solutions on victim devices.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

[Medusa Group](https://attack.mitre.org/groups/G1051) has attempted to bypass UAC using Component Object Model (COM) interface.(Citation: Intel471 Medusa Ransomware May 2025)

T1027.002Obfuscated Files or Information: Software Packing

[Medusa Group](https://attack.mitre.org/groups/G1051) has packed the code of dropped kernel drivers using the packer ASM Guard.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1027.010Obfuscated Files or Information: Command Obfuscation

[Medusa Group](https://attack.mitre.org/groups/G1051) has obfuscated PowerShell scripts with Base64 encoding.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1070.003Indicator Removal: Clear Command History

[Medusa Group](https://attack.mitre.org/groups/G1051) has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1070.004Indicator Removal: File Deletion

[Medusa Group](https://attack.mitre.org/groups/G1051) has deleted previously installed tools.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1218.014System Binary Proxy Execution: MMC

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1562Impair Defenses

Employs Windows Management Instrumentation (WMIC) command-line to delete shadow copies.

T1562.001Disable or Modify Tools

Terminates services or processes related to antivirus/security tools.

T1562.009Safe Mode Boot

Abuses Safe Mode to evade endpoint detection.

T1564.003Hide Artifacts: Hidden Window

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized the `ShowWindow` API function to hide the current window.(Citation: Security Scorecard Medusa Ransomware January 2024)

T1003.001OS Credential Dumping: LSASS Memory

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged [Mimikatz](https://attack.mitre.org/software/S0002) to dump LSASS to harvest credentials.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1003.003OS Credential Dumping: NTDS

[Medusa Group](https://attack.mitre.org/groups/G1051) has accessed the ntds.dit file to engage in credential dumping.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1110Brute Force

Uses brute force on local RDP account passwords.

T1016System Network Configuration Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1018Remote System Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has used PDQ Inventory to get an inventory of the endpoints on the network.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1033System Owner/User Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [PsExec](https://attack.mitre.org/software/S0029) to execute `quser` to discover the user session information.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1046Network Service Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has the capability to use living off the land (LOTL) binaries to perform network enumeration.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1057Process Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1069.002Permission Groups Discovery: Domain Groups

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized the `net group` command to query domain groups within the victim environment.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1082System Information Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1083File and Directory Discovery

Queries specified files, folders, and file extensions.

T1087.001Account Discovery: Local Account

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged `net user` for account discovery.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1135Network Share Discovery

Enumerates network shares.

T1518.001Software Discovery: Security Software Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1652Device Driver Discovery

[Medusa Group](https://attack.mitre.org/groups/G1051) has queried drivers on the victim device through the command `driverquery`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1021Remote Services

Uses remote services for login and lateral movement via RDP and SMB.

T1021.001Remote Services: Remote Desktop Protocol

[Medusa Group](https://attack.mitre.org/groups/G1051) has used RDP to conduct lateral movement and exfiltrate data.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1072Software Deployment Tools

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1570Lateral Tool Transfer

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1045Exfiltration Over C2 Channel

Transfers data to attacker-controlled servers via an existing command-and-control (C2) channel.

T1048Exfiltration Over Alternative Protocol

Exfiltrates data using alternative protocols, such as FTP/SFTP, to avoid detection by traditional methods.

T1567Exfiltration Over Web Service

Exfiltrates data using web services like cloud services (e.g., Google Drive, Dropbox, etc.).

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [Rclone](https://attack.mitre.org/software/S1040) to exfiltrate data from victim environments to cloud storage.(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1071.001Application Layer Protocol: Web Protocols

[Medusa Group](https://attack.mitre.org/groups/G1051) has communicated through reverse or bind shells over port 443 (HTTPS).(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1090.003Proxy: Multi-hop Proxy

[Medusa Group](https://attack.mitre.org/groups/G1051) has used TOR nodes for communications.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Check Point Medusa Ransomware April 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)

T1105Ingress Tool Transfer

Uses certutil to download malicious files.

T1219Remote Access Tools

[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Remote Access Software for lateral movement and data exfiltration.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024) [Medusa Group](https://attack.mitre.org/groups/G1051) has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1573.002Encrypted Channel: Asymmetric Cryptography

[Medusa Group](https://attack.mitre.org/groups/G1051) has used HTTPS for command and control.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1486Data Encrypted for Impact

Uses the AES-256 algorithm to encrypt files on the computer.

T1489Service Stop

Terminates processes and services related to database servers, email servers, and backups.

T1490Inhibit System Recovery

Deletes shadow copies and disables the Windows System Restore feature.

T1529System Shutdown/Reboot

[Medusa Group](https://attack.mitre.org/groups/G1051) has manually turned off and encrypted virtual machines.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1657Financial Theft

[Medusa Group](https://attack.mitre.org/groups/G1051) has stolen and encrypted victims' data in order to extort victims into paying a ransom.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Check Point Medusa Ransomware April 2025)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Intel471 Medusa Ransomware May 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)

T1583.006Acquire Infrastructure: Web Services

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1585.001Establish Accounts: Social Media Accounts

[Medusa Group](https://attack.mitre.org/groups/G1051) has created social media accounts including Telegram and X to publicize their activities.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Check Point Medusa Ransomware April 2025)

T1585.002Establish Accounts: Email Accounts

[Medusa Group](https://attack.mitre.org/groups/G1051) has created email accounts used in ransomware negotiations.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1588.002Obtain Capabilities: Tool

[Medusa Group](https://attack.mitre.org/groups/G1051) has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1608.002Stage Capabilities: Upload Tool

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1650Acquire Access

[Medusa Group](https://attack.mitre.org/groups/G1051) has purchased user credentials and other sensitive data from Initial Access Brokers (IABs).(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Check Point Medusa Ransomware April 2025)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Intel471 Medusa Ransomware May 2025)

T1112Modify Registry

[Medusa Group](https://attack.mitre.org/groups/G1051) has modified Registry keys to elevate privileges, maintain persistence and allow remote access.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1553.002Subvert Trust Controls: Code Signing

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1685Disable or Modify Tools

[Medusa Group](https://attack.mitre.org/groups/G1051) has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

T1686Disable or Modify System Firewall

[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized [PsExec](https://attack.mitre.org/software/S0029) to execute batch scripts that modify firewall settings.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.(Citation: CISA Medusa Group Medusa Ransomware March 2025)

T1690Prevent Command History Logging

[Medusa Group](https://attack.mitre.org/groups/G1051) has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)