Skip to main content
Darkfield

Operator dossier

medusalocker is a ransomware operator currently active on public leak sites. Darkfield has indexed 78 public victims claimed by this operator between November 15, 2022 and July 7, 2026. MedusaLocker is a ransomware operation first publicly documented around 2019, though the activity cluster reflected in this dataset shows observed campaigns beginning in November 2022, driven primarily by financial motivation with no known ideological or hacktivist agenda. The group is believed to operate out of or with ties to Eastern Europe, functioning as a Ransomware-as-a-Service model that allows affiliates to deploy the ransomware in exchange for a share of ransom proceeds, a structure documented in a joint advisory published by CISA, FBI, FinCEN, and HHS in June 2022. MedusaLocker actors typically gain initial access through phishing emails, exploitation of vulnerable Remote Desktop Protocol configurations, and compromised network devices, subsequently deploying the ransomware payload which encrypts victim files using AES-256 combined with RSA-2048 encryption while also exfiltrating sensitive data prior to encryption to enable double extortion pressure. Based on available telemetry, the group has claimed at least 67 known victims, with targeting concentrated heavily in the United States, United Kingdom, Brazil, France, and Israel, spanning sectors including business services, manufacturing, technology, and education, consistent with the opportunistic rather than highly selective targeting pattern characteristic of RaaS affiliate programs. As of the time of writing, MedusaLocker remains an active threat with no confirmed law enforcement disruption, takedown operation, or confirmed rebrand publicly attributed to the group by major intelligence or law enforcement agencies.

Most-targeted sectors

Most-affected countries

Recent disclosures by medusalocker

All 78 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for medusalocker →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

medusalocker

78 victims indexed · first seen 4 years ago · last activity 8 days ago

78
Victims indexed
#83 of 364 tracked operators
3y 8m
Active period
Nov 2022 → Jul 2026
17
Countries hit
top US · 9

At a glance

Status
active
First seen
4 years ago
Last activity
8 days ago
Primary sector
Not Found · 15 hits

About

MedusaLocker is a ransomware operation first publicly documented around 2019, though the activity cluster reflected in this dataset shows observed campaigns beginning in November 2022, driven primarily by financial motivation with no known ideological or hacktivist agenda. The group is believed to operate out of or with ties to Eastern Europe, functioning as a Ransomware-as-a-Service model that allows affiliates to deploy the ransomware in exchange for a share of ransom proceeds, a structure documented in a joint advisory published by CISA, FBI, FinCEN, and HHS in June 2022. MedusaLocker actors typically gain initial access through phishing emails, exploitation of vulnerable Remote Desktop Protocol configurations, and compromised network devices, subsequently deploying the ransomware payload which encrypts victim files using AES-256 combined with RSA-2048 encryption while also exfiltrating sensitive data prior to encryption to enable double extortion pressure. Based on available telemetry, the group has claimed at least 67 known victims, with targeting concentrated heavily in the United States, United Kingdom, Brazil, France, and Israel, spanning sectors including business services, manufacturing, technology, and education, consistent with the opportunistic rather than highly selective targeting pattern characteristic of RaaS affiliate programs. As of the time of writing, MedusaLocker remains an active threat with no confirmed law enforcement disruption, takedown operation, or confirmed rebrand publicly attributed to the group by major intelligence or law enforcement agencies.

References

2 links

External sources curated by the MISP threat-intel community.

Timeline

17 months
2022-11-01T00:00:00+00:00 · 202023-04-01T00:00:00+00:00 · 12023-06-01T00:00:00+00:00 · 82023-07-01T00:00:00+00:00 · 42023-08-01T00:00:00+00:00 · 12023-10-01T00:00:00+00:00 · 32023-11-01T00:00:00+00:00 · 22024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 22024-11-01T00:00:00+00:00 · 12025-01-01T00:00:00+00:00 · 12025-02-01T00:00:00+00:00 · 22025-03-01T00:00:00+00:00 · 12025-05-01T00:00:00+00:00 · 22025-09-01T00:00:00+00:00 · 12025-11-01T00:00:00+00:00 · 12026-05-01T00:00:00+00:00 · 16
2022-11-01T00:00:00+00:002026-05-01T00:00:00+00:00

Top countries

🇺🇸 United States
9
🇬🇧 United Kingdom
3
🇧🇷 Brazil
2
🇫🇷 France
1
🇮🇱 Israel
1
🇮🇹 Italy
1
🇯🇴 Jordan
1
🇦🇪 United Arab Emirates
1
United States dossier →United Kingdom dossier →Brazil dossier →France dossier →

Top sectors

Business Services
11
Manufacturing
8
Technology
8
Education
4
Financial Services
3
Construction
3
Agriculture and Food Production
3
Hospitality and Tourism
3
Business Services dossier →Manufacturing dossier →Technology dossier →Education dossier →

MITRE ATT&CK

20 techniques · 8 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryLateral MovementCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566.001Phishing: Spearphishing Attachment
  • T1059.001Command and Scripting Interpreter: PowerShell
  • T1059.003Command and Scripting Interpreter: Windows Command Shell
  • T1204.002User Execution: Malicious File
  • T1112Modify Registry
  • T1562.001Impair Defenses: Disable or Modify Tools
  • T1490Inhibit System Recovery
  • T1070.004Indicator Removal: File Deletion
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1135Network Share Discovery
  • T1021.001Remote Services: Remote Desktop Protocol
  • T1021.002Remote Services: SMB/Windows Admin Shares
  • T1039Data from Network Shared Drive
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact
  • T1489Service Stop
  • T1491.001Defacement: Internal Defacement

Recent victims

Loading…

Source

Updated 8 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time medusalocker posts a victim.

Add medusalocker to your watchlist — Pro pings you within 5 minutes of any new medusalocker leak-site post, Telegram callout, or affiliate-rebrand inference.