MedusaLocker — Ransomware Profile
MedusaLocker is a ransomware and data-extortion actor tracked by IntelFusions, linked to 16 victim listings published on data-leak sites in 2026. It is tracked separately from the Medusa ransomware-as-a-service operation.Also tracked as
BabyLockerKZ, AKO, AKO Doxware, MedusaReborn
Tools & malware
- Advanced IP Scanner Discovery/Network scanner
- Advanced Port Scanner Discovery/Network scanner
- Impacket Lateral movement
- Invoke-ReflectivePEInjection (PowerSploit) Loader/Code injection
- MedusaLocker Ransomware/Encryptor
- Mimikatz Credential theft
- PsExec Lateral movement
- SoftPerfect NetScan Discovery/Network scanner
Recent claimed victims
- Forces 2026-07-07
- Dolrad 2026-07-01
- Bd 2026-07-01
- Penticton and District Society for Community Living 2026-07-01
- Karneslegal 2026-07-01
- Sgs Gmbh 2026-07-01
- Dadolighting 2026-07-01
- T Online 2026-07-01
- FunkeScheid 2026-07-01
- Mairie Thiverval Grignon 2026-07-01
- Estrela 2026-07-01
- Desert Christian Schools (DCS) 2026-05-05
- Raycolighting 2026-05-05
- Strategic Imports 2026-05-05
- Académie de Montpellier / CSJM 2026-05-05
- Elken Sdn Bhd 2026-05-05
- Bandeirante Supermercados 2026-05-05
- Hathcock (Personal) 2026-05-05
- Trimble Inc / Gerrard Inc 2026-05-05
- CEAGESP / Netfeirasp 2026-05-05
- Colegio María Inmaculada (CMI) 2026-05-05
- Magnolia (Israel) 2026-05-05
- SIT Group / Robusta 2026-05-05
- Atencio Engineering 2026-05-05
- Palmers Relocations 2026-05-05
Vendor research
- #StopRansomware: MedusaLocker (Joint Cybersecurity Advisory AA22-181A) FBI / CISA / Treasury / FinCEN
- MedusaLocker Ransomware: Encryption, Costs, and Protection SentinelOne
- MedusaLocker v3 Ransomware Explained: Technical Analysis, Tactics and Protection Cyderes
- Cybereason vs. MedusaLocker Ransomware Cybereason
- MedusaLocker is Sweeping Its Gaze SonicWall
- MedusaLocker (Malware Family) - win.medusalocker Malpedia (Fraunhofer FKIE)