MEDUSA — Malware Profile

MEDUSA is an open-source rootkit that is capable of dynamic linker hijacking, command execution, and logging credentials.

MITRE ATT&CK techniques (4)

• T1014 Rootkit
• T1027.013 Encrypted/Encoded File
• T1563.001 SSH Hijacking
• T1574.006 Dynamic Linker Hijacking

IntelFusions coverage

• Ransomware crew Gentlemen arms affiliates with custom EDR killers 2026-06-19

Attributed threat actors

• UNC3886

Read the full analysis on IntelFusions