Medusa
Medusa is a ransomware group with a financial motive, tracked by Brandefense. It targets 18 sectors, including Government and Technology, in 41 countries, including the United States and the United Kingdom. It uses 80 MITRE ATT&CK techniques and exploits 23 known CVEs.
- Medusa Team
- Techniques
- 80
- Exploited CVEs
- 23
- First seen
- Mar 1, 2023
- Last seen
- Dec 31, 2025
- Record updated
Who They Target.
About Medusa.
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.