- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- 2021–2025
- Status
- Active
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0840 · medusa
What it is
Medusa is a long-time presence in the ransomware scene that stepped up its activities in late 2024, pushing past its previous limits.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Frozen Spider
- Other names
- Medusa Ransomware
Targets
- Sectors
- Education, Government, Healthcare, Technology
Tools
The tools and malware families the sources tie to it.
- CORESHELL
- Cyber Eye RAT
- CyberGate
- Xpert
- Xploit