Medusa Ransomware
Software · ATTACK:enterprise:S1244
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1244",
"title": "Medusa Ransomware",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1244",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--28d93902-30e7-4436-8885-6d312c51c9a3",
"external_id": "S1244",
"domain": "enterprise",
"created": "2025-10-17T11:31:38.677Z",
"modified": "2025-10-21T14:58:41.162Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
"url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
},
{
"source_name": "CISA Medusa Group Medusa Ransomware March 2025",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
},
{
"source_name": "Broadcom Medusa Ransomware Medusa Group March 2025",
"url": "https://www.security.com/threat-intelligence/medusa-ransomware-attacks"
},
{
"source_name": "Security Scorecard Medusa Ransomware January 2024",
"url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--160fe071-f28f-47c3-a87c-e7cfc9e72f31
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c792ece-e1d9-4819-9621-1b704a23839d
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b3a7b95-f253-4b43-b3b4-a158357f3820
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1679
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fe6636c-46b6-4055-a3e9-08d1bb36c6df
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34939c90-9f24-4141-9fe2-f9b150f813d8
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3924f0e4-f79b-4804-87d5-57df4ceddb95
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43a521e7-f588-4c30-b0df-f3c117d74f65
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f368185-2f3f-4a42-b106-707cd476b6b0
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60fe96a5-c2c2-4be8-8303-8f5bd1d1fb97
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68be315f-f84b-4790-892b-e284089658a8
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71f8c65a-e4fb-4aa0-88b9-353ee56da56c
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--777f1f3f-f996-45e9-85e0-f063901c1289
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--799e9c4b-2f06-4917-8f91-aa1c7773f56b
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S1244
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d7a94b0-57e0-4676-88d3-c0171403740f
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c4aec9b-9927-4903-897b-fbd6552cde2e
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d753094-3f5a-4d38-88dd-13289e1d8318
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4710756-98de-4242-b908-f9a0d6148a97
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be02d27b-302a-4850-892a-f3cc1437950d
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6f6b904-0246-471c-93ca-0b70c70b0c96
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cab0f984-4f65-4250-bf4d-36b8250dcba0
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4d8ec73-d3ac-481d-81f7-5066bf4e9579
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1c8ddae-74d1-41f2-a7ee-d0ab379d54c8
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb251021-d2a1-46bd-bf9e-e6066d03f298
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024