Medusa is a ransomware group that emerged in June 2021, initially operating as a closed entity before transitioning to an affiliate-based Ransomware-as-a-Service (RaaS) model. While affiliates launch attacks, the core group retains control over ransom negotiations. Assessed with moderate confidence to operate from Russia or an allied state, given its avoidance of targeting organizations within Russia and the Commonwealth of Independent States, alongside its activity on Russian-language dark web forums. The group's primary motivation is financial gain, employing a multi-extortion strategy that includes data encryption, data exfiltration with threats of public release, and occasionally distributed denial-of-service (DDoS) attacks. Medusa distinguishes itself by actively using public social media channels like Telegram, Facebook, and X (formerly Twitter) under the 'OSINT Without Borders' brand to exert additional pressure on victims and publicize stolen data. This group is distinct from the older MedusaLocker ransomware variant and the Medusa mobile malware variant and is tracked by Symantec as 'Spearwing'.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.