Medusalocker

☆ pin

Also known as MedusaLocker

Reports

First seen

Mar 19, 2026

Last seen

Jul 7, 2026

Motivation

Financial

Targeting

Sectors

Other ×1 Professional Services ×1 Government ×1 Telecommunications ×1

Victim regions

×1

Canada×1

France×1

Germany×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1027.002 Obfuscated Files or Information: Software Packing ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1562.006 Impair Defenses: Indicator Blocking ×1T1027 Obfuscated Files or Information ×1T1543.003 Create or Modify System Process: Windows Service ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1068 Exploitation for Privilege Escalation ×1T1489 Service Stop ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1

Indicators

filename ×49domain ×12ip_v4 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Medusalocker

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Medusalocker ransomware gang publishes new victim: Forces

Medusalocker claims new victim: Estrela

Medusalocker claims Karneslegal victim on ransomware.live

Medusalocker publishes SGS GmbH as new victim

Medusalocker publishes Dadolighting as new ransomware victim

Medusalocker claims T-Online breach with 823 emails extracted

Medusalocker claims FunkeScheid victim on ransomware.live

Medusalocker publishes Mairie Thiverval Grignon as victim

Medusalocker publishes Dolrad as new victim

Medusalocker publishes new victim: Bd

Medusalocker publishes Penticton and District Society for Community Living as ransomware victim

EDR Killers Explained: Beyond the Drivers — ESET's Analysis of 90 Active Tools