Overview
MedusaLocker is a ransomware-as-a-service operation first observed in 2019. A joint CISA, FBI, Treasury and MS-ISAC advisory (AA22-181A, 2022) describes its actors as relying mainly on vulnerable Remote Desktop Protocol configurations for initial access, with phishing and spam attachments as a second route. The group uses a double-extortion model and works with affiliates.
- First tracked: 2022-11-15
- Discussed in our reports: France
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America11
Germany5
Brazil4
Canada4
France4
United Kingdom4
United Arab Emirates3
Switzerland2
Spain2
India2
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
| Privilege Escalation |
|---|
| Parent PID Spoofing |
Technique details
Tools
- Invoke-TheHash
- Mimikatz
- HRSword
- PCHunter
- ProcessHacker
- Advanced IP Scanner
- Advanced Port Scanner
- SoftPerfect NetScan
- PsExec
- Impacket
- Remote Desktop Plus (RDP+)
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| File Manager | DLS | t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id[.]onion | Yes |
| Human Verify | DLS | medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd[.]onion | No |
| — | DLS | qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd[.]onion | No |
| Medusa Chat | Chat | 95[.]143[.]191[.]148:3000 | No |
| Ransomware blog – We will not give ourselves a name. Just watch out for the leakage of your data:) | DLS | z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11