Description
MedusaLocker is a ransomware as a service operation active since 2019 whose affiliates encrypt Windows networks and demand payment through negotiators and a leak site. The family disables security tooling, spreads through network shares, and has repeatedly targeted healthcare, manufacturing, and public sector organizations. Its long operational history and steady affiliate recruitment make it one of the more durable ransomware brands.
Stats
- First seen
- May 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| DOS.Ransomware.MedusaLocker |
| Dump:Generic.Ransom.MedusaLocker.F4BE0B97 |
| Gen:Variant.Ransom.MedusaLocker.33 |
| Gen:Variant.Ransom.MedusaLocker.34 |
| Gen:Variant.Ransom.MedusaLocker.45 |
| Gen:Variant.Ransom.MedusaLocker.61 |
| Gen:Variant.Ransom.MedusaLocker.65 |
| Generic.Ransom.MedusaLocker.0AC9A0EA |
| Generic.Ransom.MedusaLocker.17AD522D |
| Generic.Ransom.MedusaLocker.195D833B |