spearwing raas cyber attacks
Up next
Author
Tags
Share article
The post has been shared by 0 people.
Facebook 0
Twitter 0
Pinterest 0
Mail 0

While law enforcement celebrates taking down major ransomware operations like LockBit and BlackCat, a relatively new player has been quietly filling the void. Spearwing, a likely Russian-based ransomware-as-a-service (RaaS) group, has been wreaking havoc with its Medusa ransomware, amassing hundreds of victims since emerging in early 2023. Not exactly rookies anymore.

The numbers are frankly disturbing. Medusa attacks surged 42% between 2023 and 2024, then doubled in the first two months of 2025 compared to the same period last year. Over 40 organizations were hit in January and February alone. And those are just the ones they’ve bragged about on their leak site.

Their tactics? Classic digital thuggery with a modern twist. They steal your data before encrypting it (double extortion, how cute), then slap a .medusa extension on your files and drop their charming ransom note. In a recent attack, they demonstrated increased dwell time by lurking in networks four days before deploying their ransomware. Understanding their technical intelligence helps identify indicators of compromise before they can execute their full attack. Miss their 10-day deadline? That’ll be an extra $10,000 per day, thanks. Ransoms range from $100,000 to a jaw-dropping $15 million. Highway robbery has gone digital.

Spearwing’s technical approach is depressingly effective. They exploit unpatched Microsoft Exchange vulnerabilities, deploy remote management tools like AnyDesk, and use a technique called Bring Your Own Vulnerable Driver to disable security software. The group has targeted nearly 400 victims since January 2023, showing their significant operational scale. Then they move laterally through networks using legitimate tools. Living off the land, as the security pros call it.

Healthcare, manufacturing, and education sectors are their favorite targets, with particular focus on organizations in the US, UK, Canada, Australia, France, and Italy. Curiously, they avoid Russia and Commonwealth states. Shocking, right?

Tracked by Symantec’s Threat Hunter Team, Spearwing is now competing with emerging groups like RansomHub and Qilin in the post-LockBit landscape. Their consistent tactics suggest a structured operation with limited affiliates or a tight playbook.

The ransomware ecosystem adapts fast. Take down one group, another fills the gap. Nature abhors a vacuum, especially in cybercrime.

References

You May Also Like
ransomware attack data crisis

Tata Technologies Faces Data Crisis After Ransomware Attack – Will They Survive the Aftermath?

Tata Technologies battles devastating 1.4TB data breach as Hunters International threatens to expose 730,000 files. Could this be the final blow for India’s tech giant? Cybersecurity failures have consequences.
ransomware investigation challenges faced

Bis Industries Faces Dark Cyber Challenges in Investigating Ransomware Claims

Bis Industries grapples with a Christmas-period ransomware attack that exposed 500GB of sensitive data. RansomHub’s darknet threats could devastate the mining giant’s operations. Most companies never recover.
ransomware extortion via mail

Is Snail Mail the New Frontier for Ransomware Extortion Tactics?

Ransomware gangs abandon digital attacks for your mailbox! Physical letters demanding $500k bypass security systems, creating panic among executives. Your mail screening could be fatally flawed.
ransomware breach exposes student data

Elite Bronx Private School Faces Major Crisis After Ransomware Breach Exposes Student Data

Elite Bronx school’s 42GB student data nightmare: RansomHub exposed medical records and contact info of $57,000-a-year students on the dark web. Most schools are dangerously unprepared.