MedusaLocker

MedusaLocker is a Windows ransomware family associated with financially motivated extortion operations. It encrypts victim files and has been observed targeting local systems, mapped and shared network drives, and removable media, making it capable of impacting both standalone hosts and broader enterprise environments. The malware uses Windows cryptographic APIs and has been analyzed as employing symmetric file encryption with the resulting key protected by an embedded RSA public key. It commonly drops an HTML ransom note and repeatedly rescans infected systems for newly created files that remain unencrypted.

MedusaLocker includes multiple anti-recovery and defense-impairment behaviors. Observed variants delete shadow copies, remove restore points, disable startup repair, and attempt to terminate processes associated with security products and business applications. Some intrusions linked to MedusaLocker have also involved dedicated antivirus- and EDR-killing tooling, including bring-your-own-vulnerable-driver techniques used to disable endpoint protections before ransomware execution. Persistence has been observed through self-copying under deceptive system-like names and startup registration.

Intrusions associated with MedusaLocker have frequently been linked to opportunistic access methods, especially exposed or weakly protected RDP services, including brute-force activity and use of valid administrative credentials. Post-compromise activity has included credential theft with Mimikatz, lateral movement with administrative tooling such as PsExec and WMI-based execution, and network reconnaissance with scanning and share-enumeration utilities. Additional reporting has tied some MedusaLocker deployments to exploitation of internet-facing software and to HeartCrypt-packed payload chains in which a packed dropper is followed by an AV-killer component and then ransomware execution.

MedusaLocker has affected organizations across multiple countries and sectors, including public-sector entities, manufacturing, telecommunications, legal and business services. It is distinct from the separate Medusa ransomware operation and from other malware families using similar naming.