MedusaLocker

MedusaLocker is a Windows ransomware family active since late 2019 and distinct from the Medusa ransomware operation. It is assessed to operate as a ransomware-as-a-service ecosystem, with affiliates conducting intrusions and sharing ransom proceeds with operators. MedusaLocker has affected organizations worldwide, including healthcare, education, government, finance, manufacturing, and technology sectors.

Operators commonly obtain access through exposed or weakly protected Remote Desktop Protocol services, compromised RDP or SMB credentials, vulnerable VPN and edge infrastructure, and phishing or spam email campaigns carrying malicious attachments or download links. The ransomware encrypts local volumes, mapped drives, accessible SMB shares, and other reachable network storage using AES encryption with RSA public-key protection. Variants may use partial, multithreaded encryption to increase speed and impact.

MedusaLocker performs network discovery through ICMP probing and SMB-share enumeration, enabling encryption across accessible network resources. It can terminate security, database, accounting, virtualization, and business-application processes to unlock files and reduce defenses. It also deletes shadow copies and backups, disables recovery features, and may restart systems in Safe Mode to impair endpoint protection. Persistence is commonly achieved through a copied executable and scheduled-task or Run-key execution. Some variants use UAC-bypass techniques to obtain elevated execution.

Later variants support double extortion: operators claim to steal confidential data before encryption and threaten public disclosure if payment is not made. Ransom notes direct victims to negotiate through attacker-controlled contact channels and may offer limited decryption as proof of recovery capability.