medusalocker is a ransomware operator currently active on public leak sites. Darkfield has indexed 67 public victims claimed by this operator between November 15, 2022 and May 5, 2026. MedusaLocker is a ransomware group that emerged in November 2022, operating with primarily financial motivations and targeting organizations across multiple sectors including technology, energy, healthcare, and manufacturing. The group's origin and specific affiliations remain largely undocumented in public threat intelligence reports, though their operational patterns suggest they may operate as part of the broader ransomware-as-a-service ecosystem that has proliferated in recent years. With 51 documented victims primarily concentrated in the United States, United Arab Emirates, Germany, Canada, and Antigua and Barbuda, MedusaLocker appears to focus on opportunistic targeting rather than specific geographic or sectoral specialization. The group's attack methodology and specific technical capabilities have not been extensively documented by major threat intelligence organizations, though their targeting of critical infrastructure sectors including healthcare and energy suggests they likely employ common ransomware tactics such as network encryption and potential data exfiltration. No major high-profile attacks or significant law enforcement disruptions against MedusaLocker have been publicly reported by CISA, FBI, or other major security agencies. The current operational status of MedusaLocker remains unclear due to limited public documentation, though the relatively recent emergence date suggests the group may still be active or have transitioned to other operations.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.