Medusa is a ransomware group that emerged in June 2021, initially operating as a closed entity before transitioning to an affiliate-based Ransomware-as-a-Service (RaaS) model. While affiliates launch attacks, the core group retains control over ransom negotiations. Assessed with moderate confidence to operate from Russia or an allied state, given its avoidance of targeting organizations within Russia and the Commonwealth of Independent States, alongside its activity on Russian-language dark web forums. The group's primary motivation is financial gain, employing a multi-extortion strategy that includes data encryption, data exfiltration with threats of public release, and occasionally distributed denial-of-service (DDoS) attacks. Medusa distinguishes itself by actively using public social media channels like Telegram, Facebook, and X (formerly Twitter) under the 'OSINT Without Borders' brand to exert additional pressure on victims and publicize stolen data. This group is distinct from the older MedusaLocker ransomware variant and the Medusa mobile malware variant and is tracked by Symantec as 'Spearwing'.^1,2

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.