Ransomware group profile · #71 by claimed victims

Medusalocker ransomware

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

Active First seen Nov 2022

103Victims claimed on leak sites

2Victims in the last 30 days

25Victims in the last 90 days

28Countries hit

0Leak-site URLs tracked

5 Oct 2026Latest claim recorded

Victimology

Who Medusalocker claims to have breached, from 103 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing18

Technology16

Professional Services14

Other6

Retail & E-Commerce6

Agriculture and Food Production5

Government & Defense5

Education5

Top countries

United States11

Germany5

Canada4

Brazil4

United Kingdom4

France4

United Arab Emirates3

Australia2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Millensys millensys.com	Technology	BR	5 Oct 2026
Rueegseggerag rueegseggerag.ch	Not Found	CH	5 Oct 2026
PKSF — Palli Karma-Sahayak Foundation 08trl.exit	Financial Services	BD	28 Sep 2026
Juntadeandalucia juntadeandalucia.es	Government & Defense	ES	28 Sep 2026
Premiumfruits premiumfruits.eu	Agriculture and Food Production	ES	28 Sep 2026
ATCO Ltd mail.gmail.com	Energy & Utilities	CA	28 Sep 2026
Aokkef aokkef.fr	Not Found	FR	23 Sep 2026
Seznam seznam.cz	Technology	CZ	23 Sep 2026
Abv abv.bg	Other	BG	23 Sep 2026
瑞祥机电 (Ruixiang Jidian)	Manufacturing	CN	12 Sep 2026
Abourametals abourametals.com	Manufacturing	AE	12 Sep 2026
Frisby Roofing (Frisby Construction LLC) frisbyconstruction.com	Other	US	12 Sep 2026

All 103 Medusalocker victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Medusalocker is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Medusalocker ransomware still active?

Medusalocker is tracked as active. The most recent leak-site claim VULONE recorded is dated 5 October 2026. 2 victims were claimed in the last 30 days.

How many victims has Medusalocker claimed?

VULONE has recorded 103 leak-site victim claims attributed to Medusalocker since November 2022, across 28 countries and 14 sectors.

Which industries does Medusalocker target?

The sectors most often named on the Medusalocker leak site are Manufacturing, Technology, Professional Services.

Which countries are most affected by Medusalocker?

Most Medusalocker victims recorded by VULONE are located in United States, Germany, Canada.

Where does VULONE get Medusalocker victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.