Medusalocker

☆ pin

Also known as MedusaLocker

Reports

First seen

Mar 19, 2026

Last seen

Oct 5, 2026

Motivation

Financial

Targeting

Sectors

Government ×2 Manufacturing ×2 Retail & E-commerce ×2 Financial Services ×2 Other ×1 Professional Services ×1 Telecommunications ×1 Healthcare ×1

Victim regions

×1

×2

Canada×2

India×2

France×1

Germany×1

United States×1

China×1

Czechia×1

Spain×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1489 Service Stop ×1T1562.006 Impair Defenses: Indicator Blocking ×1T1068 Exploitation for Privilege Escalation ×1T1027.002 Obfuscated Files or Information: Software Packing ×1T1543.003 Create or Modify System Process: Windows Service ×1T1027 Obfuscated Files or Information ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1

Indicators

filename ×49domain ×43ip_v4 ×24hash_md5 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Medusalocker

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Medusalocker claims Millensys victim on ransomware.live

Medusalocker publishes new victim: Rueegseggerag

Medusalocker publishes PKSF as new ransomware victim

Medusalocker publishes Junta de Andalucía as ransomware victim

Medusalocker publishes Premiumfruits as ransomware victim

Medusalocker publishes ATCO Ltd as new victim

Medusalocker publishes new victim: Aokkef

Medusalocker publishes Seznam as new ransomware victim

Medusalocker publishes new victim: Abv

Medusalocker claims Ruixiang Jidian victim on ransomware.live

Medusalocker claims Abourametals in ransomware extortion post

Medusalocker claims Frisby Roofing victim on ransomware.live leak site

Medusalocker publishes Praveg Caves Jawai as ransomware victim

Medusalocker publishes LIC India as ransomware victim

Medusalocker publishes Lawter as new ransomware victim

Medusalocker publishes new victim: Jgsee

Medusalocker publishes Servifruit as new ransomware victim

Medusalocker publishes Hungry Lion as ransomware victim

Medusalocker claims Qualisteel in ransomware extortion

Medusalocker publishes new victim in healthcare sector

Medusalocker publishes new victim: Twal Family IT Lab

Medusalocker publishes All Parts Dry Cleaning as ransomware victim

Medusalocker publishes Idex Group as ransomware victim

Medusalocker publishes Bija Industrie as ransomware victim

Medusalocker publishes new victim: Thecourierguy

Medusalocker ransomware gang publishes new victim: Forces

Medusalocker claims new victim: Estrela

Medusalocker claims Karneslegal victim on ransomware.live

Medusalocker publishes SGS GmbH as new victim

Medusalocker publishes Dadolighting as new ransomware victim