Medusa

How Medusa typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Medusa Group, Medusa Ransomware.

1. T1583.006 Web Services Resource Development

   What they do: Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.

   What that means: Adversaries may register for web services that can be used during targeting.

2. T1585.001 Social Media Accounts Resource Development

   What they do: Medusa Group has created social media accounts including Telegram and X to publicize their activities.

   What that means: Adversaries may create and cultivate social media accounts that can be used during targeting.

3. T1585.002 Email Accounts Resource Development

   What they do: Medusa Group has created email accounts used in ransomware negotiations.

   What that means: Adversaries may create email accounts that can be used during targeting.

4. T1588.002 Tool Resource Development

   What they do: Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning.

   What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.

5. T1608.002 Upload Tool Resource Development

   What they do: Medusa Group has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.

   What that means: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.

6. T1650 Acquire Access Resource Development

   What they do: Medusa Group has purchased user credentials and other sensitive data from Initial Access Brokers (IABs).

   What that means: Adversaries may purchase or otherwise acquire an existing access to a target system or network.

7. T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: Medusa Group has utilized compromised legitimate local and domain accounts within the victim environment to facilitate remote access and lateral movement sometimes in combination with PsExec.

   What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

8. T1190 Exploit Public-Facing Application Initial Access

   What they do: Medusa Group has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access.

   What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

9. T1047 Windows Management Instrumentation Execution

   What they do: Medusa Group has utilized Windows Management Instrumentation to query system information.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

10. T1059.001 PowerShell Execution

    What they do: Medusa Group has leveraged PowerShell for execution and defense evasion.

    What that means: Adversaries may abuse PowerShell commands and scripts for execution.

11. T1059.003 Windows Command Shell Execution

    What they do: Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.

    What that means: Adversaries may abuse the Windows command shell for execution.

12. T1072 Software Deployment Tools ExecutionLateral Movement

    What they do: Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.

    What that means: Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.

13. T1106 Native API Execution

    What they do: Medusa Group has leveraged Windows Native API functions to execute payloads.

    What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

14. T1559 Inter-Process Communication Execution

    What they do: Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.

    What that means: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

15. T1559.001 Component Object Model Execution

    What they do: Medusa Group has leveraged Component Object Model (COM) to bypass UAC.

    What that means: Adversaries may use the Windows Component Object Model (COM) for local code execution.

16. T1569.002 Service Execution Execution

    What they do: Medusa Group has utilized PsExec to execute scripts and commands within victim environments.

    What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

17. T1112 Modify Registry PersistenceDefense Impairment

    What they do: Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.

    What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

18. T1136.002 Domain Account Persistence

    What they do: Medusa Group has created a domain account within the victim environment.

    What that means: Adversaries may create a domain account to maintain access to victim systems.

19. T1505.003 Web Shell Persistence

    What they do: Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.

    What that means: Adversaries may backdoor web servers with web shells to establish persistent access to systems.

20. T1543.003 Windows Service PersistencePrivilege Escalation

    What they do: Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.

    What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

21. T1548.002 Bypass User Account Control Privilege Escalation

    What they do: Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.

    What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

22. T1027.002 Software Packing Stealth

    What they do: Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.

    What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

23. T1027.010 Command Obfuscation Stealth

    What they do: Medusa Group has obfuscated PowerShell scripts with Base64 encoding.

    What that means: Adversaries may obfuscate content during command execution to impede detection.

24. T1027.013 Encrypted/Encoded File Stealth

    What they do: Medusa Ransomware has utilized XOR encrypted strings.

    What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

25. T1070.003 Clear Command History Stealth

    What they do: Medusa Group has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.

    What that means: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

26. T1070.004 File Deletion Stealth

    What they do: Medusa Group has deleted previously installed tools.

    What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

27. T1140 Deobfuscate/Decode Files or Information Stealth

    What they do: Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.

    What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

28. T1218.014 MMC Stealth

    What they do: Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.

    What that means: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

29. T1564.003 Hidden Window Stealth

    What they do: Medusa Group has utilized the `ShowWindow` API function to hide the current window.

    What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

30. T1679 Selective Exclusion Stealth

    What they do: Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.

    What that means: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution.

31. T1553.002 Code Signing Defense Impairment

    What they do: Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.

    What that means: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

32. T1685 Disable or Modify Tools Defense Impairment

    What they do: Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

33. T1686 Disable or Modify System Firewall Defense Impairment

    What they do: Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings.

    What that means: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action.

34. T1690 Prevent Command History Logging Defense Impairment

    What they do: Medusa Group has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.

    What that means: Adversaries may impair command history logging to hide commands they run on a compromised system.

35. T1003.001 LSASS Memory Credential Access

    What they do: Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.

    What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

36. T1003.003 NTDS Credential Access

    What they do: Medusa Group has accessed the ntds.dit file to engage in credential dumping.

    What that means: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

37. T1007 System Service Discovery Discovery

    What they do: Medusa Ransomware has leveraged an encoded list of services that it designates for termination.

    What that means: Adversaries may try to gather information about registered local system services.

38. T1016 System Network Configuration Discovery Discovery

    What they do: Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

39. T1018 Remote System Discovery Discovery

    What they do: Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

40. T1033 System Owner/User Discovery Discovery

    What they do: Medusa Group has utilized PsExec to execute `quser` to discover the user session information.

    What that means: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

41. T1046 Network Service Discovery Discovery

    What they do: Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration.

    What that means: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

42. T1057 Process Discovery Discovery

    What they do: Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.

    What that means: Adversaries may attempt to get information about running processes on a system.

43. T1069.002 Domain Groups Discovery

    What they do: Medusa Group has utilized the `net group` command to query domain groups within the victim environment.

    What that means: Adversaries may attempt to find domain-level groups and permission settings.

44. T1082 System Information Discovery Discovery

    What they do: Medusa Group has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

45. T1083 File and Directory Discovery Discovery

    What they do: Medusa Group has searched for files within the victim environment for encryption and exfiltration.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

46. T1087.001 Local Account Discovery

    What they do: Medusa Group has leveraged `net user` for account discovery.

    What that means: Adversaries may attempt to get a listing of local system accounts.

47. T1124 System Time Discovery Discovery

    What they do: Medusa Ransomware has discovered device uptime through `GetTickCount()`.

    What that means: An adversary may gather the system time and/or time zone settings from a local or remote system.

48. T1135 Network Share Discovery Discovery

    What they do: Medusa Group has identified network shares using `cmd.exe /c net share`.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

49. T1518.001 Security Software Discovery Discovery

    What they do: Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

    What that means: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

50. T1652 Device Driver Discovery Discovery

    What they do: Medusa Group has queried drivers on the victim device through the command `driverquery`.

    What that means: Adversaries may attempt to enumerate local device drivers on a victim host.

51. T1680 Local Storage Discovery Discovery

    What they do: Medusa Ransomware has enumerated logical drives on infected hosts.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

52. T1021.001 Remote Desktop Protocol Lateral Movement

    What they do: Medusa Group has used RDP to conduct lateral movement and exfiltrate data.

    What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

53. T1570 Lateral Tool Transfer Lateral Movement

    What they do: Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.

    What that means: Adversaries may transfer tools or other files between systems in a compromised environment.

54. T1071.001 Web Protocols Command and Control

    What they do: Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).

    What that means: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

55. T1090.003 Multi-hop Proxy Command and Control

    What they do: Medusa Group has used TOR nodes for communications.

    What that means: Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

56. T1105 Ingress Tool Transfer Command and Control

    What they do: Medusa Group has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.

57. T1219 Remote Access Tools Command and Control

    What they do: Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration.

    What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.

58. T1573.002 Asymmetric Cryptography Command and Control

    What they do: Medusa Group has used HTTPS for command and control.

    What that means: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

59. T1567.002 Exfiltration to Cloud Storage Exfiltration

    What they do: Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.

    What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

60. T1486 Data Encrypted for Impact Impact

    What they do: Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

61. T1489 Service Stop Impact

    What they do: Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

62. T1490 Inhibit System Recovery Impact

    What they do: Medusa Group has deleted recovery files such as shadow copies using `vssadmin.exe`.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

63. T1529 System Shutdown/Reboot Impact

    What they do: Medusa Group has manually turned off and encrypted virtual machines.

    What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

64. T1657 Financial Theft Impact

    What they do: Medusa Group has stolen and encrypted victims' data in order to extort victims into paying a ransom.

    What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Software Medusa has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

$$\      $$\ $$$$$$$$\ $$$$$$$\  $$\   $$\  $$$$$$\   $$$$$$\  
$$$\    $$$ |$$  _____|$$  __$$\ $$ |  $$ |$$  __$$\ $$  __$$\ 
$$$$\  $$$$ |$$ |      $$ |  $$ |$$ |  $$ |$$ /  \__|$$ /  $$ |
$$\$$\$$ $$ |$$$$$\    $$ |  $$ |$$ |  $$ |\$$$$$$\  $$$$$$$$ |
$$ \$$$  $$ |$$  __|   $$ |  $$ |$$ |  $$ | \____$$\ $$  __$$ |
$$ |\$  /$$ |$$ |      $$ |  $$ |$$ |  $$ |$$\   $$ |$$ |  $$ |
$$ | \_/ $$ |$$$$$$$$\ $$$$$$$  |\$$$$$$  |\$$$$$$  |$$ |  $$ |
\__|     \__|\________|\_______/  \______/  \______/ \__|  \__|
-----------------------------[ Hello, [snip] !!! ]--------------------------

WHAT HAPPEND?
------------------------------------------------------------
1. We have PENETRATE your network and COPIED data.
* We have penetrated entire network including backup system and researched all about your data.
* And we have extracted all of your networks including sub offices and your service clients networks valuable data and copied them to private cloud storage.

2. We have ENCRYPTED some your files.
While you are reading this message, it means you found your files and data has been ENCRYPTED by world's strongest ransomware.
We have access to all of your sub offices and client service networks but didn't lock them all for your brand and privacy.
We can solve this issue sliently and smoothly without 3rd parties and we decided lock only some of your main network only.
But don't worry, we can restore everything to the original without harming your business.

There is only one possible way to get back your systems and business - CONTACT us via LIVE CHAT and pay for the special 
MEDUSA DECRYPTOR and DECRYPTION KEYs, Data deletion, Keep silent in media.
This MEDUSA DECRYPTOR will restore your entire network, This will take less than 1 business day.


WHAT GUARANTEES?
---------------------------------------------------------------
We can post your data to the public and send emails to your customers.
We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. Have a look about us on twitter.

You can suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, 
 costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues.
After paying for the data breach and decryption, we guarantee that your data will never be leaked and this is also for our reputation.

YOU should be AWARE!
---------------------------------------------------------------
If you're not in main chile office, inform your supervisors and stay calm!
We will speak only with an authorized person. It can be the CEO, top management, etc.
In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!


If you do not contact us within 3 days, We will start publish your case to our official blog and everybody will start notice your incident!
If you do not contact us within 5 days, We will start publish your case and leak video on all social channels and send emails to your customers!
--------------------[ Official blog tor address ]--------------------
Using TOR Browser(https://www.torproject.org/download/):

http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/


CONTACT US!
----------------------[ Your company live chat address ]---------------------------
Using TOR Browser(https://www.torproject.org/download/):

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/[snip]

Or Use Tox Chat Program(https://qtox.github.io/)
Add user with our tox ID and wait 24h : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F

Our support email: ( [email protected] )

Company identification hash:
[snip]

$$\      $$\ $$$$$$$$\ $$$$$$$\  $$\   $$\  $$$$$$\   $$$$$$\  
$$$\    $$$ |$$  _____|$$  __$$\ $$ |  $$ |$$  __$$\ $$  __$$\ 
$$$$\  $$$$ |$$ |      $$ |  $$ |$$ |  $$ |$$ /  \__|$$ /  $$ |
$$\$$\$$ $$ |$$$$$\    $$ |  $$ |$$ |  $$ |\$$$$$$\  $$$$$$$$ |
$$ \$$$  $$ |$$  __|   $$ |  $$ |$$ |  $$ | \____$$\ $$  __$$ |
$$ |\$  /$$ |$$ |      $$ |  $$ |$$ |  $$ |$$\   $$ |$$ |  $$ |
$$ | \_/ $$ |$$$$$$$$\ $$$$$$$  |\$$$$$$  |\$$$$$$  |$$ |  $$ |
\__|     \__|\________|\_______/  \______/  \______/ \__|  \__|
-----------------------------[ Hello, [snip] !!! ]--------------------------

Sorry to interrupt your busy business.

WHAT HAPPEND?
------------------------------------------------------------
1. We have PENETRATE your network and COPIED data.
We have penetrated your entire network and researched all about your data.
And we have copied all of your confidential data and uploaded to private storage.
* You're running a highly valued business and your data was very crucial.

2. We have ENCRYPTED your files.
While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware.
Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files.
But don't worry, we can decrypt your files.

There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special 
MEDUSA DECRYPTOR and DECRYPTION KEYs.
This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day.


WHAT GUARANTEES?
---------------------------------------------------------------
We can post all of your critial data to the public and send emails to your competitors.
We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us.
You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, 
 costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues.

After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation.

YOU should be AWARE!
---------------------------------------------------------------
We will speak only with an authorized person. It can be the CEO, top management etc.
In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!
Inform your supervisors and stay calm!


If you do not contact us within 48 hours, We will start publish your case to our official blog and everybody will start notice your incident!
--------------------[ Telegram channel ]--------------------

https://t.me/+yXOcSjVjI9tjM2E0


--------------------[ Official blog tor address ]--------------------
Using TOR Browser(https://www.torproject.org/download/):

http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
http://cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion/


CONTACT US!
----------------------[ Your company live chat address ]---------------------------
Using TOR Browser(https://www.torproject.org/download/):

http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/[snip]

Backup Mirrors:
http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/[snip]

--------------------[ Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) ]--------------------
Add user with our tox ID : 061AA6BDE8F6DE6C92F0D6E077359BF6911FCAF80030E82B3A3DB65E63C8011343D34F956FEC

Our support email: ( [email protected] )

Company identification hash:
[snip]

Ransom-note text from RansomLook, licensed CC BY 4.0.