Medusa Group

Medusa is a ransomware gang, also referred to in the content as Medusa Group and Medusa ransomware. It is described as a representative ransomware group capable of targeting major-event-related organizations and has been active across at least 2020 through 2025 in ransomware-brand tracking. The group claimed responsibility for a February 2025 attack on UK healthcare provider HCRG Care Group; HCRG confirmed it had been breached and said it was investigating. The content associates Medusa with exploitation of remote monitoring and management software, specifically AnyDesk, as one of the adversaries observed exploiting that software. Medusa is also linked to use of EDR-disabling tooling in ransomware intrusions. ESET telemetry cited in the content says affiliates of Medusa have used AbyssKiller, and Sophos reporting says CardSpaceKiller has appeared in intrusions involving Medusa. Separate reporting also links Poortry, a malicious kernel driver and loader set used to sabotage endpoint protection, to attacks involving Medusa. The content further states that Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices. The content references MITRE ATT&CK annotations for Medusa Group including T1059.001 (PowerShell), T1068 (Exploitation for Privilege Escalation), T1090.003 (Multi-hop Proxy), and T1543.003 (Windows Service). It also places Medusa within a broader ransomware ecosystem: operators of the Gentlemen ransomware operation were reported to include former affiliates of Medusa alongside Qilin, Embargo, LockBit, and BlackLock; and ESET noted connections between RansomHub and peers including Play, Medusa, and BianLian. Known aliases in the provided content include Medusa, Medusa Group, Medusa ransomware, and medusa_ransomware_group.