'Spearwing' RaaS Group Ruffles Feathers in Cyber Threat Scene

Medusa ransomware, attributed to a group known as "Spearwing," has been used in double-extortion campaigns since 2023 with nearly 400 victims listed on its leak site; ransom demands range from $100,000 to $15 million. The group exploits unpatched public-facing services (notably Microsoft Exchange), leverages remote management and admin tools for lateral movement, appends a .medusa extension and drops a "!READ_ME_MEDUSA!!!.txt" ransom note, and may operate either as a tightly controlled RaaS or a single cohesive operator with consistent TTPs.