Grupo APTMITRE G1051

Medusa Group

[Medusa Group](https://attack.mitre.org/groups/G1051) has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” (Citation: CISA Medusa Group Medusa Ransomware March 2025) (Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. (Citation: Security Scorecard Medusa Ransomware January 2024) For initial access, [Medusa Group](https://attack.mitre.org/groups/G1051) has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. (Citation: Intel471 Medusa Ransomware May 2025)

Víctimas en los últimos 90 días0

Países más afectados

Sin datos todavía.

Sectores más afectados

Sin datos todavía.

Mitigaciones prioritarias

Mitigaciones de MITRE ATT&CK que cubren más técnicas de las que usa este grupo.

Gestión de cuentas privilegiadas (12 técnicas cubiertas)
Gestión de cuentas de usuario (11 técnicas cubiertas)
Prevención de ejecución (9 técnicas cubiertas)
Configuración del sistema operativo (8 técnicas cubiertas)
Prevención de comportamientos en el endpoint (7 técnicas cubiertas)
Desactivar o eliminar funciones o programas (7 técnicas cubiertas)
Segmentación de red (6 técnicas cubiertas)
Prevención de intrusiones en red (6 técnicas cubiertas)

Técnicas MITRE ATT&CK

T1490 · Inhibit System Recovery T1047 · Windows Management Instrumentation T1570 · Lateral Tool Transfer T1543.003 · Windows Service T1489 · Service Stop T1106 · Native API T1583.006 · Web Services T1608.002 · Upload Tool T1027.010 · Command Obfuscation T1083 · File and Directory Discovery T1112 · Modify Registry T1588.002 · Tool T1087.001 · Local Account T1585.001 · Social Media Accounts T1567.002 · Exfiltration to Cloud Storage T1070.003 · Clear Command History T1650 · Acquire Access T1071.001 · Web Protocols T1686 · Disable or Modify System Firewall T1564.003 · Hidden Window T1135 · Network Share Discovery T1090.003 · Multi-hop Proxy T1190 · Exploit Public-Facing Application T1218.014 · MMC T1585.002 · Email Accounts T1078 · Valid Accounts T1105 · Ingress Tool Transfer T1057 · Process Discovery T1559.001 · Component Object Model T1219 · Remote Access Tools T1003.003 · NTDS T1018 · Remote System Discovery T1569.002 · Service Execution T1003.001 · LSASS Memory T1573.002 · Asymmetric Cryptography T1486 · Data Encrypted for Impact T1059.001 · PowerShell T1136.002 · Domain Account T1657 · Financial Theft T1652 · Device Driver Discovery T1690 · Prevent Command History Logging T1027.002 · Software Packing T1070.004 · File Deletion T1059.003 · Windows Command Shell T1069.002 · Domain Groups T1553.002 · Code Signing T1505.003 · Web Shell T1529 · System Shutdown/Reboot T1518.001 · Security Software Discovery T1016 · System Network Configuration Discovery T1685 · Disable or Modify Tools T1046 · Network Service Discovery T1033 · System Owner/User Discovery T1082 · System Information Discovery T1021.001 · Remote Desktop Protocol T1072 · Software Deployment Tools T1548.002 · Bypass User Account Control

Víctimas recientes

Sin datos todavía.

Las reivindicaciones las publican los propios grupos criminales y no están verificadas hasta que la organización o la prensa las confirman. Los nombres de personas físicas (autónomos, profesionales individuales) se anonimizan conforme al RGPD. Nunca enlazamos a sitios de filtración ni a datos robados. Para solicitar la retirada o anonimización de una entrada, contacte con el administrador del sitio.

Fuentes: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.