Medusalocker

☆ pin

Also known as MedusaLocker

Reports

First seen

Mar 19, 2026

Last seen

Sep 2, 2026

Motivation

Financial

Targeting

Sectors

Retail & E-commerce ×2 Other ×1 Professional Services ×1 Government ×1 Telecommunications ×1 Manufacturing ×1 Healthcare ×1 Financial Services ×1

Victim regions

×1

Canada×1

France×1

Germany×1

India×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1027.002 Obfuscated Files or Information: Software Packing ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1543.003 Create or Modify System Process: Windows Service ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1489 Service Stop ×1T1562.006 Impair Defenses: Indicator Blocking ×1T1027 Obfuscated Files or Information ×1T1068 Exploitation for Privilege Escalation ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1

Indicators

filename ×49domain ×26ip_v4 ×22hash_md5 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Medusalocker

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Medusalocker publishes LIC India as ransomware victim

Medusalocker publishes Lawter as new ransomware victim

Medusalocker publishes new victim: Jgsee

Medusalocker publishes Servifruit as new ransomware victim

Medusalocker publishes Hungry Lion as ransomware victim

Medusalocker claims Qualisteel in ransomware extortion

Medusalocker publishes new victim in healthcare sector

Medusalocker publishes new victim: Twal Family IT Lab

Medusalocker publishes All Parts Dry Cleaning as ransomware victim

Medusalocker publishes Idex Group as ransomware victim

Medusalocker publishes Bija Industrie as ransomware victim

Medusalocker publishes new victim: Thecourierguy

Medusalocker ransomware gang publishes new victim: Forces

Medusalocker claims new victim: Estrela

Medusalocker claims Karneslegal victim on ransomware.live

Medusalocker publishes SGS GmbH as new victim

Medusalocker publishes Dadolighting as new ransomware victim

Medusalocker claims T-Online breach with 823 emails extracted

Medusalocker claims FunkeScheid victim on ransomware.live

Medusalocker publishes Mairie Thiverval Grignon as victim

Medusalocker publishes Dolrad as new victim

Medusalocker publishes new victim: Bd

Medusalocker publishes Penticton and District Society for Community Living as ransomware victim

EDR Killers Explained: Beyond the Drivers — ESET's Analysis of 90 Active Tools