Medusalocker

| active

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

External information

https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022

Victims

49

First Discovered

victim

2022-11-15

Last Discovered

victim

2025-05-30

Inactive Since

in day(s)

86

Avg Delay

between attack and claim

88.2 days

Infostealer

for victim with domain

0.0%

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
None	No	2025-06-01 21:19:12		`qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion`
Ransomware blog – We will not give ourselves a name. Just watch out for the leakage of your data:)	Yes	2025-08-24 04:31:14	nginx 1.18.0	`z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion`
Medusa Chat	No	2025-06-01 21:20:10		`95.143.191.148:3000`
Human Verify	No	2025-06-01 21:20:46		`medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (1)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced IP Scanner Advanced Port Scanner SoftPerfect NetScan	Remote Desktop Plus (RDP+) placeholder placeholder	HRSword PCHunter ProcessHacker	Invoke-TheHash Mimikatz placeholder	Impacket placeholder placeholder	placeholder placeholder placeholder	PsExec placeholder placeholder	placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (20)

SHA256 19 TOX 1

Type	IOC
`sha256`	`dc4840a0992b218cbedd5a7ac5c711cb98f1f9e78a8ffdea37c694061dfd34c6`
`sha256`	`48046fb0e566f5a2d184f84b76d6cadc458762556daed0ae4a3a1200afbefb54`
`sha256`	`c0c726a23111c220d022fcd01a85f9788249e42baece03f83b6059170453b801`
`sha256`	`012657c4548d9c98223caa4cc7aa52fc083d6983d42fde16ca3271412e7fe3fe`
`sha256`	`8edbb1944d94ff91ee917c31590b6d1d5690a52fc153e44355ee9749aa0f4625`
`sha256`	`364f1b7466d8e4c9f55294ecf1f874c763bcf980c59b0250c613ac366def6aca`
`sha256`	`5d5d639fdfbf632bb7d9f1bb28731217d09d36078ab5e594baf2a5a41267a5d2`
`sha256`	`33a8024395c56fab4564b9baef1645e505e00b0b36bff6fad3aedb666022599a`
`sha256`	`b8c994e3ed7dcc9080916119ddc315533c129479f508676d7544b82b2e24745f`
`sha256`	`63eb3d2886d9cb880c9b0d54b94f3e149b3b5b6215a33a0ef63588a09dcd4499`
`sha256`	`270c3354b3ee2940b499e365eaba143fba9d458f434dc38e663dc0f08e96121e`
`sha256`	`759b96f44806578cc0836a3a2bf11c8bc553effac72f8d28b94aec78b66be906`
`sha256`	`9f066975f1e02b29c7c635280f405c59704ce4f4e06b04e9ac8a7eac22acd3c7`
`sha256`	`8bc455e5de35290f8a94376357947bd72aaf6f4d452c25a8ef444e037ef76b9f`
`sha256`	`d00f7cf6af68ba832b9d364f28411346cfe66fd3b1f5bcac318766add29ff7f0`
`sha256`	`1f2df15442593b159e45d16a27e4d43d3a9062da212a588ba4c048f214a0b7be`
`sha256`	`1e9246e6a35731143368eaa0ade4f3cf576d6b22e6090152f6e94f1fa3070651`
`sha256`	`6ae3a58a78be9c606009c657de4e390538b21ad951e62b6f4d31138e1a75732c`
`sha256`	`2eddfe711c32ef1668e14a10d00452c83c29e394e17c41f491550a1583c1bcac`
`tox`	`E9CD65687463F67F64937E961DD723DC82C79CB548375AAE8AA4A0698D356C5E7E157B22E8CD`

Victims (49)

UnigazJordan Medusalocker

Discovery Date: 2025-05-30

www.unigaz.net $690.6 Million The list of files is available at the link https://dropmefiles.com/9HG...

Mulia Raya Medusalocker

Discovery Date: 2025-05-29

www.muliaraya.co.id $34.8 Million The list of files is available at the link https://dropmefiles.com...

Curtain Bluff Medusalocker

Discovery Date: 2025-03-25

www.curtainbluff.com Curtain Bluff files Vacationer information (personal data), audit information (...

Inversiones Clinica Del Meta SA Medusalocker

Discovery Date: 2025-02-28

www.clinicameta.co Description employee information – patient information – agreements – password da...

MICRO MANUFACTRING Medusalocker

Discovery Date: 2025-02-12
Estimated Attack Date: 2025-02-06

Micro Manufacturing Inc. Descriptionemployee information – agreement – customer email(.xls)-.msg out...

bendixengineering Medusalocker

Discovery Date: 2025-01-09

Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Data-2016-2024...

SILKNET COMPANY Medusalocker

Discovery Date: 2024-11-26

URL:https://silknet.com https://geocell.ge/ On sale:Company email base(about 1tb)Customer dataCompan...

Protected: HIDE NAME Medusalocker

Discovery Date: 2024-05-09

There is no excerpt because this is a protected post....

SHAMASS.ORG Medusalocker

Discovery Date: 2024-05-02
Estimated Attack Date: 2024-04-22

Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Price-$50000 (...

Protected: HIDE NAME SELL DATA SOON Medusalocker

Discovery Date: 2024-04-26
Estimated Attack Date: 2024-04-25

There is no excerpt because this is a protected post....

Protected: Name is hidden Medusalocker

Discovery Date: 2023-11-29

There is no excerpt because this is a protected post....

skalar.com Medusalocker

Discovery Date: 2023-11-29

There is no excerpt because this is a protected post....

Ada-Borup-West School Medusalocker

Discovery Date: 2023-10-23

Descriptionemployee information – student information – all contracts Price: 35000$...

wellons.org Medusalocker

Discovery Date: 2023-10-23

Descriptionemployee information – agreement – customer email(.xls)- pst files 15+GB all outlook mess...

Confidential files Medusalocker

Discovery Date: 2023-10-02

A large number of documents of large companies are available for sale Revenue-$10-$70kk Financial do...

INSULCANA CONTRACTING LTD Medusalocker

Discovery Date: 2023-08-03
Estimated Attack Date: 2023-07-27

Descriptionemployee information – agreement – customer email(.xls)- passport all canada and other do...

Protected: INSULCANA CONTRACTING LTD Medusalocker

Discovery Date: 2023-07-27

There is no excerpt because this is a protected post....

Protected: Hidden name Medusalocker

Discovery Date: 2023-07-17

There is no excerpt because this is a protected post....

Hoosier Equipment company Medusalocker

Discovery Date: 2023-07-04

DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$...

Ucamco Belgium Medusalocker

Discovery Date: 2023-07-02

DescriptionClient Case – customers email-Audit information-There is also access to email for newslet...

reutlingen.ihk.de Medusalocker

Discovery Date: 2023-06-24
Estimated Attack Date: 2023-06-16

DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000...

Hausamman company Medusalocker

Discovery Date: 2023-06-24
Estimated Attack Date: 2023-06-16

DescriptionClient Case – customers email-documents PRICE-$20000...

kafflogistic.hu Medusalocker

Discovery Date: 2023-06-24
Estimated Attack Date: 2023-06-17

DescriptionClient Case – agreement – email(outlook files)- contracts – and other documents PRICE-$50...

SELL DATA(qtox) Medusalocker

Discovery Date: 2023-06-24
Estimated Attack Date: 2023-06-17

Available for sale: to buy please contact qtox price negotiable qtox-E9CD65687463F67F64937E961DD723D...

Jalux Americas, Inc. Medusalocker

Discovery Date: 2023-06-14
Estimated Attack Date: 2021-11-03

DescriptionClient Case – agreement – email(.msg) – and other documents Price: 160000$The company fai...

arborsct.com Medusalocker

Discovery Date: 2023-06-14

DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$ One copy will be...

Salmon Software Medusalocker

Discovery Date: 2023-06-03
Estimated Attack Date: 2022-07-11

DescriptionClient Case – agreement – email(.msg)- passport- and other documents Price: 120000$ Three...

LETAPE JEUNES Medusalocker

Discovery Date: 2023-06-03
Estimated Attack Date: 2023-06-02

DescriptionClient Case – agreement – email(.msg)- contracts – and other documents(passports) PRICE-$...

bsw-architects.com Medusalocker

Discovery Date: 2023-04-11

DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000 There...

DGLEGAL Medusalocker