Home › Threat Actors › Spearwing
← All Threat Actors
Cybercrime high Criminal (non-state) RaaS operation. No nation-state attribution applies to Spearwing/Medusa itself — this is distinct from North Korea's Lazarus/Stonefly subgroup, which has separately been confirmed deploying the Medusa encryptor as an affiliate/customer, not as Spearwing's own operators.

Spearwing

Spearwing (tracking name per Picus Security research); Microsoft tracks the same operator as Storm-1175. Financially motivated ransomware-as-a-service (RaaS) core team maintaining the Medusa encryptor, negotiation infrastructure, and Medusa Blog leak site. · Financial — triple extortion (encryption, data-leak threat, and in some cases DDoS) against victims, with affiliate recruitment paid $100–$1,000,000 per valid network access.

Reports 1
Active Since Emerged 2022; scaled to 500+ confirmed victims and 300+ critical infrastructure targets by 2025–2026
Last Reported 13 Aug 2026
Sectors Targeted healthcare, education, finance, professional-services, manufacturing

Tactics, Techniques & Procedures (TTPs)

  • Exploitation of CVE-2024-1709 (ConnectWise ScreenConnect auth bypass) and CVE-2023-48788 (Fortinet FortiClient EMS SQLi/RCE) for initial access
  • Purchase of credentials/access from initial access brokers
  • AnyDesk and PsExec for lateral movement and remote execution
  • Mimikatz for credential harvesting
  • ABYSSWORKER — a signed kernel driver (smuol.sys) disguised as CrowdStrike's CSAgent.sys, using stolen/revoked Chinese code-signing certificates, to kill EDR/AV processes and strip kernel callbacks (BYOVD)
  • Medusa encryptor packed with HeartCrypt packer-as-a-service
  • Rclone for data staging/exfiltration to cloud storage
  • PowerShell command history wiping before encryption to destroy forensic evidence

Known Targets

HealthcareEducationManufacturingLegalInsuranceTechnologyCritical infrastructure (300+ orgs per CISA)Primarily North America and Western Europe; victims reported in 40+ countries

Analyst Notes

Subject of joint CISA/FBI/MS-ISAC advisory AA25-071A. In 2026, Symantec/Carbon Black confirmed North Korea's Lazarus Group (Stonefly/Andariel subgroup) deploying the Medusa encryptor against US healthcare and a Middle East organization — a separate actor using Spearwing's RaaS product, not evidence that Spearwing itself is state-sponsored.

Also Known As

Storm-1175 (Microsoft)Medusa (ransomware/brand name)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1562.001 Impair Defenses: Disable or Modify Tools T1003.001 OS Credential Dumping: LSASS Memory T1570 Lateral Tool Transfer T1567.002 Exfiltration to Cloud Storage T1070.003 Indicator Removal: Clear Command History

Intelligence Reports

Analysis healthcareeducation

Medusa Ransomware: The 500-Victim Operation Using a CrowdStrike Lookalike to Kill EDR

Medusa is a ransomware-as-a-service operation with more than 500 confirmed victims across healthcare, education, manufacturing, and legal. Its ABYSSWORKER kernel driver — signed with stolen Chinese certificates and disguised to mimic a CrowdStrike component — disables endpoint defences before encryption. North Korea's Lazarus Group has now been confirmed deploying Medusa in targeted campaigns, blurring the line between criminal RaaS and nation-state operations.

13 Aug 2026 · 13 min read