Ransomware group profile · #73 by claimed victims

Medusalocker ransomware

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

Active First seen Nov 2022

94Victims claimed on leak sites

11Victims in the last 30 days

27Victims in the last 90 days

24Countries hit

0Leak-site URLs tracked

12 Sep 2026Latest claim recorded

Victimology

Who Medusalocker claims to have breached, from 94 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing18

Technology14

Professional Services14

Retail & E-Commerce6

Other5

Education5

Agriculture and Food Production4

Healthcare4

Top countries

United States11

Germany5

United Kingdom4

Brazil3

United Arab Emirates3

France3

Canada3

India2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
瑞祥机电 (Ruixiang Jidian)	Manufacturing	CN	12 Sep 2026
Abourametals abourametals.com	Manufacturing	AE	12 Sep 2026
Frisby Roofing (Frisby Construction LLC) frisbyconstruction.com	Other	US	12 Sep 2026
Praveg Caves Jawai	Hospitality	IN	12 Sep 2026
Licindia licindia.com	Other	IN	2 Sep 2026
Lawter lawter.com	Manufacturing	US	1 Sep 2026
Jgsee jgsee.kmutt.ac.th	Not Found	TH	27 Aug 2026
Servifruit servifruit.com	Agriculture and Food Production	MX	27 Aug 2026
Hungry Lion	Retail & E-Commerce	GH	27 Aug 2026
Qualisteel qualisteel.com	Manufacturing	—	27 Aug 2026
Health health.nsw.gov.au	Healthcare	AU	27 Aug 2026
Twal Family IT Lab	Technology	—	16 Aug 2026

All 94 Medusalocker victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Medusalocker is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Medusalocker ransomware still active?

Medusalocker is tracked as active. The most recent leak-site claim VULONE recorded is dated 12 September 2026. 11 victims were claimed in the last 30 days.

How many victims has Medusalocker claimed?

VULONE has recorded 94 leak-site victim claims attributed to Medusalocker since November 2022, across 24 countries and 14 sectors.

Which industries does Medusalocker target?

The sectors most often named on the Medusalocker leak site are Manufacturing, Technology, Professional Services.

Which countries are most affected by Medusalocker?

Most Medusalocker victims recorded by VULONE are located in United States, Germany, United Kingdom.

Where does VULONE get Medusalocker victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].