spearwing raas cyber attacks
Up next
Author
Tags
Share article
The post has been shared by 0 people.
Facebook 0
Twitter 0
Pinterest 0
Mail 0

While law enforcement celebrates taking down major ransomware operations like LockBit and BlackCat, a relatively new player has been quietly filling the void. Spearwing, a likely Russian-based ransomware-as-a-service (RaaS) group, has been wreaking havoc with its Medusa ransomware, amassing hundreds of victims since emerging in early 2023. Not exactly rookies anymore.

The numbers are frankly disturbing. Medusa attacks surged 42% between 2023 and 2024, then doubled in the first two months of 2025 compared to the same period last year. Over 40 organizations were hit in January and February alone. And those are just the ones they’ve bragged about on their leak site.

Their tactics? Classic digital thuggery with a modern twist. They steal your data before encrypting it (double extortion, how cute), then slap a .medusa extension on your files and drop their charming ransom note. In a recent attack, they demonstrated increased dwell time by lurking in networks four days before deploying their ransomware. Understanding their technical intelligence helps identify indicators of compromise before they can execute their full attack. Miss their 10-day deadline? That’ll be an extra $10,000 per day, thanks. Ransoms range from $100,000 to a jaw-dropping $15 million. Highway robbery has gone digital.

Spearwing’s technical approach is depressingly effective. They exploit unpatched Microsoft Exchange vulnerabilities, deploy remote management tools like AnyDesk, and use a technique called Bring Your Own Vulnerable Driver to disable security software. The group has targeted nearly 400 victims since January 2023, showing their significant operational scale. Then they move laterally through networks using legitimate tools. Living off the land, as the security pros call it.

Healthcare, manufacturing, and education sectors are their favorite targets, with particular focus on organizations in the US, UK, Canada, Australia, France, and Italy. Curiously, they avoid Russia and Commonwealth states. Shocking, right?

Tracked by Symantec’s Threat Hunter Team, Spearwing is now competing with emerging groups like RansomHub and Qilin in the post-LockBit landscape. Their consistent tactics suggest a structured operation with limited affiliates or a tight playbook.

The ransomware ecosystem adapts fast. Take down one group, another fills the gap. Nature abhors a vacuum, especially in cybercrime.

References

You May Also Like
ransomware investigation challenges faced

Bis Industries Faces Dark Cyber Challenges in Investigating Ransomware Claims

Bis Industries grapples with a Christmas-period ransomware attack that exposed 500GB of sensitive data. RansomHub’s darknet threats could devastate the mining giant’s operations. Most companies never recover.
north korea ransomware attack

North Korea’s Moonstone Sleet Unleashes Qilin Ransomware: Are You Next?

North Korea’s hackers abandon homegrown tools for Qilin ransomware, demanding millions from victims worldwide. Your business could be their next payday. No organization is truly safe.
yushin america ransomware attack

Yushin America, Inc. Becomes Latest Victim of Qilin Ransomware’s Alarming Attack

Qilin ransomware gang captures another victim: Yushin America now facing devastating data exposure and operational collapse. Small manufacturers are increasingly defenseless against these ruthless digital predators.
ebyte ransomware targets windows users

Ebyte Ransomware: Elevating Encryption Threats Against Vulnerable Windows Users

This open-source ransomware weaponizes ChaCha20 encryption against vulnerable Windows users while masquerading as “educational.” Learn how the Ebyte threat forces victims to pay cryptocurrency or lose everything forever.