Skip to main content
Darkfield

Operator dossier

Medusa (also tracked as MedusaLocker, MEDUSA LOCKER) is a ransomware operator currently active on public leak sites. Darkfield has indexed 635 public victims claimed by this operator between November 15, 2022 and May 5, 2026. Medusa, also known as MedusaLocker, is a financially motivated ransomware group that emerged in November 2022 and has since compromised 568 known victims across multiple countries. The group's origin and specific affiliations remain unclear from publicly available intelligence, though their operational patterns suggest they function as an independent ransomware operation rather than a documented Ransomware-as-a-Service model. Medusa primarily targets organizations in the United States, United Kingdom, Canada, Italy, and Australia, with a focus on business services, healthcare, manufacturing, and technology sectors, employing typical ransomware tactics including data encryption and likely exfiltration for double extortion purposes, though specific technical methodologies and initial access vectors have not been extensively documented in public threat intelligence reports. While the group has maintained a relatively high victim count since its emergence, detailed information about specific notable campaigns, high-profile victims, or major ransom demands has not been widely reported by major cybersecurity firms or law enforcement agencies. As of current intelligence assessments, Medusa appears to remain active in the threat landscape, continuing to target organizations across their established geographic and sectoral preferences.

Most-targeted sectors

Most-affected countries

Recent disclosures by Medusa

Most recent 150 of 635 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Medusa →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Medusa

aka MedusaLocker, MEDUSA LOCKER · 635 victims indexed · first seen 4 years ago · last activity 2 months ago

635
Victims indexed
#16 of 364 tracked operators
3y 6m
Active period
Nov 2022 → May 2026
30
Countries hit
top United States · 316

At a glance

Status
active
Aliases
MedusaLocker, MEDUSA LOCKER
First seen
4 years ago
Last activity
2 months ago
Onion sites
14 known endpoints
Primary sector
Business Services · 82 hits

About

Medusa, also known as MedusaLocker, is a financially motivated ransomware group that emerged in November 2022 and has since compromised 568 known victims across multiple countries. The group's origin and specific affiliations remain unclear from publicly available intelligence, though their operational patterns suggest they function as an independent ransomware operation rather than a documented Ransomware-as-a-Service model. Medusa primarily targets organizations in the United States, United Kingdom, Canada, Italy, and Australia, with a focus on business services, healthcare, manufacturing, and technology sectors, employing typical ransomware tactics including data encryption and likely exfiltration for double extortion purposes, though specific technical methodologies and initial access vectors have not been extensively documented in public threat intelligence reports. While the group has maintained a relatively high victim count since its emergence, detailed information about specific notable campaigns, high-profile victims, or major ransom demands has not been widely reported by major cybersecurity firms or law enforcement agencies. As of current intelligence assessments, Medusa appears to remain active in the threat landscape, continuing to target organizations across their established geographic and sectoral preferences.

References

8 links

External sources curated by the MISP threat-intel community.

Timeline

24 months
2024-04-01T00:00:00+00:00 · 232024-05-01T00:00:00+00:00 · 312024-06-01T00:00:00+00:00 · 172024-07-01T00:00:00+00:00 · 172024-08-01T00:00:00+00:00 · 42024-09-01T00:00:00+00:00 · 262024-10-01T00:00:00+00:00 · 172024-11-01T00:00:00+00:00 · 202024-12-01T00:00:00+00:00 · 132025-01-01T00:00:00+00:00 · 242025-02-01T00:00:00+00:00 · 352025-03-01T00:00:00+00:00 · 212025-04-01T00:00:00+00:00 · 142025-05-01T00:00:00+00:00 · 112025-06-01T00:00:00+00:00 · 72025-07-01T00:00:00+00:00 · 52025-08-01T00:00:00+00:00 · 62025-09-01T00:00:00+00:00 · 62025-10-01T00:00:00+00:00 · 202025-11-01T00:00:00+00:00 · 152025-12-01T00:00:00+00:00 · 52026-01-01T00:00:00+00:00 · 12026-02-01T00:00:00+00:00 · 52026-05-01T00:00:00+00:00 · 16
2024-04-01T00:00:00+00:002026-05-01T00:00:00+00:00

Top countries

🇺🇸 United States
316
🇬🇧 United Kingdom
45
🇨🇦 Canada
40
🇮🇹 Italy
17
🇦🇺 Australia
15
🇫🇷 France
13
🇧🇷 Brazil
11
🇩🇪 Germany
8
United States dossier →United Kingdom dossier →Canada dossier →Italy dossier →

Top sectors

Business Services
82
Healthcare
64
Manufacturing
62
Technology
55
Education
40
Construction
27
Government
27
Financial Services
20
Business Services dossier →Healthcare dossier →Manufacturing dossier →Technology dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionCredential AccessImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1133External Remote Services
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Indicators of compromise

Known tools

ConnectWiseAnyDeskPsExecMimikatzAdvanced IP Scanner

Detection · YARA rules

1 rule

  • Medusa_Ransomware

    Detects Medusa/MedusaLocker ransomware

    source: CISA AA25-071A

Recent victims

Loading…

Onion infrastructure

14 known
  • http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion
  • http://cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion
  • http://dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion
  • http://kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion
  • http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion
  • http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion
  • http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/api/search?company=&page=0
  • http://osintcorp.net
  • http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
  • http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion
  • http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion
  • http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/api/search?company=&page=0
  • + 2 more endpoints

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Medusa posts a victim.

Add Medusa to your watchlist — Pro pings you within 5 minutes of any new Medusa leak-site post, Telegram callout, or affiliate-rebrand inference.