Medusa Group
IntrusionSet · ATTACK:enterprise:G1051
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1051",
"title": "Medusa Group",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1051",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--918da025-04bd-48af-b6c4-f3e4d1b915eb",
"external_id": "G1051",
"domain": "enterprise",
"created": "2025-10-15T18:54:55.000Z",
"modified": "2026-07-31T18:48:09.341Z",
"version": "1.0",
"aliases": [
"Medusa Group"
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA Medusa Group Medusa Ransomware March 2025",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
},
{
"source_name": "Intel471 Medusa Ransomware May 2025",
"url": "https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"
},
{
"source_name": "Broadcom Medusa Ransomware Medusa Group March 2025",
"url": "https://www.security.com/threat-intelligence/medusa-ransomware-attacks"
},
{
"source_name": "Security Scorecard Medusa Ransomware January 2024",
"url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
}
]
}Explicit source assertions (62)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--003071c1-a640-4f29-8405-a3998dfaf11f
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--022896ea-ed59-4782-8d53-d559ffcbd64b
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Intel471 Medusa Ransomware May 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--042c9210-4367-4dd5-8056-d4bd8d3ae92f
Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06a238f1-b231-4f90-8576-eaa107ce73a2
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06a73a32-7ccc-4be5-ae78-7688f121c8e1
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f4a9bce-7e94-4c6f-83b1-49f842aa42c9
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13dac934-b216-4e70-8435-93c86cad9ccf
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1608.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a03f0c5-d8d3-4f5d-9808-9faad0061c14
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--203e846e-c99d-457f-80b7-11cba574a869
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--204086ef-c546-47fd-8844-b8af57085f26
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22af9ec6-fb67-4007-85f8-70a3be7f209f
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23aad43d-0475-407c-ac15-c654ca40273e
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dedd50c-be3d-4523-8949-8669314bbc7e
Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f689d2d-0088-44b3-9fe8-3c2396d28b19
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4352e4ed-ef43-43eb-ab99-e10edba99a1c
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0160
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4437897d-7914-4eab-97e7-e5c6538afaf2
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49f16587-6e49-470a-99eb-33bebc68b84a
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1650
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49fe715a-116a-4ecd-9973-00ac71519c45
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025 · CISA Medusa Group Medusa Ransomware March 2025 · Intel471 Medusa Ransomware May 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dee2c05-e3eb-495e-ab23-c656324bcda1
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ee52edf-aa8a-40e1-a9ab-532724d17224
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5991c9be-2b16-4099-9c01-4361b6f4b333
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bc76bbe-dd5b-4787-ba2d-67ff5d76fbe9
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6066869c-5883-457f-bf48-10f453039b94
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62ab55a6-4341-41df-866d-5cc784770e6f
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1218.014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--651627bc-6297-45b3-a856-87af91672179
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--780f7b55-e82f-4c62-85af-316c817f1cc4
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--797bea76-9542-4254-bbf1-1df474d02301
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b80314c-db86-42f1-8b77-e86c6d29e728
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d0f57f6-6bed-44b2-a6b2-0e3da3e57f5e
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S1244
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d7a94b0-57e0-4676-88d3-c0171403740f
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80f8b06e-a4a5-41d0-8828-1c77f796a39a
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--846b91d5-1e97-4fb2-a7ae-a8088e06566a
Intel471 Medusa Ransomware May 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88fe25f5-7274-47bf-bdbc-8e1f1d127bdc
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b8e829b-9f29-4677-8f22-f63b6c49a115
Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bda3a33-7524-49e8-aa93-708d2b6a6b17
Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c0f1ff3-4188-423d-ae8c-19f799a9fb73
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c1d86fe-96c6-43e7-ab15-a45ee477006f
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95faa9d3-5d41-4f2e-8383-93b72ab43b45
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--973de5df-473f-4791-877d-9c8e7b5527e4
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98e2f79a-e394-4d26-a82e-a15c235d28dd
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025 · CISA Medusa Group Medusa Ransomware March 2025 · Intel471 Medusa Ransomware May 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d228708-e032-412b-ae8f-bad40349bc02
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f54634b-967b-45c2-91de-680f1cbe9b52
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025 · CISA Medusa Group Medusa Ransomware March 2025 · Intel471 Medusa Ransomware May 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a15517f7-62c1-4b25-b763-e033d44ee41b
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1652
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3bf8937-d52e-41db-88f7-6b8d29a30c04
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b45ff516-1b86-4a9c-a93f-10de8ed41af5
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b50a1ecc-5c2e-472e-8320-6d708a4bd043
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7f089f2-77a0-432c-912b-8b3e8cadb111
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c42c033c-f5a5-42f3-9d5b-021a024ff88b
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4551406-93c4-4d91-8353-b51b57206911
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5407242-9958-4786-9e7f-264ff1851987
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cde53969-2e25-4424-b840-fe42806ee64e
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d329f896-6016-46b6-a66c-3e57964f95ab
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc81d3d6-c3e6-4f95-8143-e2da3ab5232a
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfe9848e-3805-4f7f-bcaa-97de676d1823
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e308d29c-a762-4885-87dc-a1d139bd55f1
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9027e50-c7dc-4bba-b19b-cd402c00b99c
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebf193e2-d75e-4204-80cd-a9791d7d3c18
CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eea81537-0c40-4b50-963d-d4f61ccf0554
Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efa41e3c-752a-43e4-81e4-dfac1dbd75a3
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f188d3ac-2bc0-4721-be80-d82323e87355
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5c91894-57ae-4e16-945f-8ad04f9c2d85
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8dbd7fd-5639-413f-92cd-4e3c4151384a
Intel471 Medusa Ransomware May 2025