MEDUSA — Malware Profile
MEDUSA is an open-source rootkit that is capable of dynamic linker hijacking, command execution, and logging credentials.
MITRE ATT&CK techniques (4)
- T1014 Rootkit
- T1027.013 Encrypted/Encoded File
- T1563.001 SSH Hijacking
- T1574.006 Dynamic Linker Hijacking
IntelFusions coverage
- Ransomware crew Gentlemen arms affiliates with custom EDR killers 2026-06-19
- Android trojan cuts off Play Protect with a fake VPN 2026-09-23