Medusalocker
| Active
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
Victims
78
First Discovered
2022-11-15
victim
Last Discovered
2026-07-07
victim
Inactive Since
26
days
Avg Delay
83.1
days
Infostealer
35.7%
victims with domain
Countries
18
hit
Attack Velocity — Last 12 months
Exclusive interview with the ransomware group medusalocker
from the CyberSecurityIL Telegram Channel —
ransomware-interviews.base44.app
Known Locations (5)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-05-27T11:05:57 |
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
|
||||
|
Ransomware blog – We will not give ourselves a name. Just watch out for the leakage of your data:) | No | 2026-04-28T07:27:23 |
z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion
|
|||
|
Medusa Chat | No | 2026-04-28T07:22:16 |
95.143.191.148:3000
|
|||
|
Human Verify | No | 2026-04-28T07:29:55 |
medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion
|
|||
|
Verifying... | Yes | 2026-08-02T01:40:41 | nginx |
t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion
|
Target
Top 5 Activity Sectors
- Professional Services 14
- Manufacturing 13
- Technology 12
- Education 5
- Government & Defense 4
Top 5 Countries
-
United States
9
-
Germany
4
-
Canada
3
-
Brazil
3
-
United Kingdom
3
Heatmap
Ransom Notes (1)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Advanced IP Scanner
Advanced Port Scanner
SoftPerfect NetScan
|
Remote Desktop Plus (RDP+)
|
HRSword
PCHunter
ProcessHacker
|
Invoke-TheHash
Mimikatz
|
Impacket
|
|
PsExec
|
|
TTPs Matrix (1)
| Privilege Escalation |
|---|
| Parent PID Spoofing |
YARA Rules (1)
Indicators of Compromise (IoCs) (25)
Email
2
Hash SHA256
20
Registry Key
1
tox
2
Victims (78)
Notarkanzlei FunkeScheid, Kanzlei im Ostend, Frankfurt. 9755 emails. AD: Kanzlei.FunkeScheid.com…
Organization with 162 emails extracted. Domain: mairie-thiverval-grignon.fr…
Canadian charity providing disability-related services. CRA Registration: 119090686RR0001 | Penticto…
Australian auto parts/batteries importer. Brands: Strategic Imports, Auto Parts Now, Discount Batter…
Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sel…
Technology company Trimble (trimble.com) and Gerrard Inc (gerrardinc.com). ~18 Trimble email address…
Civil engineering & land surveying firm. Services: site plans, boundary surveys, OWTS (septic) desig…
Italian company SIT Group (sitgroup.it) and Bulgarian Robusta (robusta.bg). Also abv.bg emails.…
K-12 Christian school affiliated with First Baptist Church of Lancaster, CA. ADP payroll, DCFS child…
Court technology company. Domain courtsmart.com / COURTSMART2. Dev server: dev-rich20.courtsmart.com…
Personal comprehensive reports. Individuals: Noel Ray Hathcock, Trinity John Hathcock.…
NGO sector. Domains: actionaid.org, tacosa.org.za, immigration.go.tz.…
Australian international removals & relocation company. FIDI accredited, ISO 9001:2015 certified. Se…
French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.f…
Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01,…
Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil…
Price-$40000 (sale in one hand there are options for making a profit from these files will be includ…
Price-$120000 (sale in one hand there are options for making a profit from these files will be inclu…
www.unigaz.net $690.6 Million The list of files is available at the link https://dropmefiles.com/9HG…
www.muliaraya.co.id $34.8 Million The list of files is available at the link https://dropmefiles.com…
www.curtainbluff.com Curtain Bluff files Vacationer information (personal data), audit information (…
www.clinicameta.co Description employee information – patient information – agreements – password da…
Micro Manufacturing Inc. Descriptionemployee information – agreement – customer email(.xls)-.msg out…
Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Data-2016-2024…
URL:https://silknet.com https://geocell.ge/ On sale:Company email base(about 1tb)Customer dataCompan…
Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Price-$50000 (…
There is no excerpt because this is a protected post.…
Descriptionemployee information – student information – all contracts Price: 35000$…
Descriptionemployee information – agreement – customer email(.xls)- pst files 15+GB all outlook mess…
A large number of documents of large companies are available for sale Revenue-$10-$70kk Financial do…
Descriptionemployee information – agreement – customer email(.xls)- passport all canada and other do…
There is no excerpt because this is a protected post.…
DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$…
DescriptionClient Case – customers email-Audit information-There is also access to email for newslet…
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000…
DescriptionClient Case – agreement – email(outlook files)- contracts – and other documents PRICE-$50…
Available for sale: to buy please contact qtox price negotiable qtox-E9CD65687463F67F64937E961DD723D…
DescriptionClient Case – agreement – email(.msg) – and other documents Price: 160000$The company fai…
DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$ One copy will be…
DescriptionClient Case – agreement – email(.msg)- passport- and other documents Price: 120000$ Three…
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents(passports) PRICE-$…
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000 There…
