Operator dossier

Medusa (also tracked as MedusaLocker) is a ransomware operator currently active on public leak sites. Darkfield has indexed 568 public victims claimed by this operator between November 15, 2022 and February 14, 2026. Medusa, also known as MedusaLocker, is a financially motivated ransomware group that emerged in November 2022 and has since compromised 568 known victims across multiple countries. The group's origin and specific affiliations remain unclear from publicly available intelligence, though their operational patterns suggest they function as an independent ransomware operation rather than a documented Ransomware-as-a-Service model. Medusa primarily targets organizations in the United States, United Kingdom, Canada, Italy, and Australia, with a focus on business services, healthcare, manufacturing, and technology sectors, employing typical ransomware tactics including data encryption and likely exfiltration for double extortion purposes, though specific technical methodologies and initial access vectors have not been extensively documented in public threat intelligence reports. While the group has maintained a relatively high victim count since its emergence, detailed information about specific notable campaigns, high-profile victims, or major ransom demands has not been widely reported by major cybersecurity firms or law enforcement agencies. As of current intelligence assessments, Medusa appears to remain active in the threat landscape, continuing to target organizations across their established geographic and sectoral preferences.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Medusa

aka MedusaLocker · 568 victims indexed · first seen 4 years ago · last activity 3 months ago

568

Victims indexed

#16 of 348 tracked operators

3y 3m

Active period

Nov 2022 → Feb 2026

Countries hit

top United States · 270

At a glance

Status: active
Aliases: MedusaLocker
First seen: 4 years ago
Last activity: 3 months ago
Onion sites: 14 known endpoints
Primary sector: Business Services · 64 hits

About

Medusa, also known as MedusaLocker, is a financially motivated ransomware group that emerged in November 2022 and has since compromised 568 known victims across multiple countries. The group's origin and specific affiliations remain unclear from publicly available intelligence, though their operational patterns suggest they function as an independent ransomware operation rather than a documented Ransomware-as-a-Service model. Medusa primarily targets organizations in the United States, United Kingdom, Canada, Italy, and Australia, with a focus on business services, healthcare, manufacturing, and technology sectors, employing typical ransomware tactics including data encryption and likely exfiltration for double extortion purposes, though specific technical methodologies and initial access vectors have not been extensively documented in public threat intelligence reports. While the group has maintained a relatively high victim count since its emergence, detailed information about specific notable campaigns, high-profile victims, or major ransom demands has not been widely reported by major cybersecurity firms or law enforcement agencies. As of current intelligence assessments, Medusa appears to remain active in the threat landscape, continuing to target organizations across their established geographic and sectoral preferences.

References

8 links

External sources curated by the MISP threat-intel community.

Timeline

24 months

2024-03-01T00:00:00+00:002026-02-01T00:00:00+00:00

Top countries

🇺🇸 United States

270

🇬🇧 United Kingdom

🇨🇦 Canada

🇮🇹 Italy

🇦🇺 Australia

🇧🇷 Brazil

🇫🇷 France

🇮🇳 India

United States dossier →United Kingdom dossier →Canada dossier →Italy dossier →

Top sectors

Business Services

Not Found

Healthcare

Manufacturing

Technology

Education

Government

Agriculture and Food Production

Business Services dossier →Not Found dossier →Healthcare dossier →Manufacturing dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionCredential AccessImpact

Techniques

T1190Exploit Public-Facing Application
T1133External Remote Services
T1059Command and Scripting Interpreter
T1486Data Encrypted for Impact

Indicators of compromise

Known tools

ConnectWiseAnyDeskPsExecMimikatzAdvanced IP Scanner

Detection · YARA rules

1 rule

Medusa_Ransomware
Detects Medusa/MedusaLocker ransomware
source: CISA AA25-071A

Recent victims

Loading…

Onion infrastructure

14 known

http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion
http://cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion
http://dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion
http://kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion
http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion
http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion
http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/api/search?company=&page=0
http://osintcorp.net
http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/api/search?company=&page=0
+ 2 more endpoints

Source

Updated 3 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.