MedusaLocker — Ransomware Profile
MedusaLocker is a ransomware and data-extortion actor tracked by IntelFusions, linked to more than 25 victim listings published on data-leak sites during 2026. It is tracked separately from the Medusa ransomware-as-a-service operation.Also tracked as
BabyLockerKZ, AKO, AKO Doxware, MedusaReborn
IntelFusions coverage (2)
- Brazilian state health agency hit, then named on leak site 2026-11-08 · Cyber Incidents
- Leak sites turn on Southeast Asia's listed companies 2026-09-03 · Cyber Incidents
Tools & malware
- Advanced IP Scanner Discovery/Network scanner
- Advanced Port Scanner Discovery/Network scanner
- Checker Attack toolkit (credential management, lateral movement; paid_memes PDB string)
- HRSword EDR/AV disabling tool
- Impacket Lateral movement
- Invoke-ReflectivePEInjection (PowerSploit) Loader/Code injection
- MedusaLocker Ransomware/Encryptor
- MIMIK Credential theft (Mimikatz and rclone wrapper)
- Mimikatz Credential theft
- PCHunter64 Process/kernel inspection utility
- Process Hacker Process monitoring and administration
- PsExec Lateral movement
- PTH Pass-the-hash toolkit (embedded PowerShell, Invoke-TheHash based)
- Remote Desktop Plus Remote access utility (bundled inside Checker)
- SoftPerfect NetScan Discovery/Network scanner
Recent claimed victims
- Geetees 2026-11-04
- Kde 2026-11-04
- Jobmongers 2026-11-04
- bataaab 2026-11-04
- Vinitgloves 2026-11-04
- Ruixiang Jidian 2026-11-04
- BCH 2026-11-04
- bamawat 2026-11-04
- Hirschinjurylaw 2026-11-04
- The Courier Guy 2026-11-04
- Interativa Plasticos (Interplast) 2026-11-04
- Ulaval 2026-11-04
- baiapai 2026-11-04
- Dian 2026-11-04
- On 2026-11-04
- Jatl 2026-11-04
- Msn 2026-11-04
- baeaqab 2026-11-04
- Rueegseggerag 2026-10-05
- Millensys 2026-10-05
- Premiumfruits 2026-09-28
- Juntadeandalucia 2026-09-28
- PKSF — Palli Karma-Sahayak Foundation 2026-09-28
- ATCO Ltd 2026-09-28
- Aokkef 2026-09-23
Vendor research
- Threat actor believed to be spreading new MedusaLocker variant since 2022 Cisco Talos
- MedusaLocker Ransomware: Encryption, Costs, and Protection SentinelOne
- MedusaLocker v3 Ransomware Explained: Technical Analysis, Tactics and Protection Cyderes
- #StopRansomware: MedusaLocker (Joint Cybersecurity Advisory AA22-181A) FBI / CISA / Treasury / FinCEN
- MedusaLocker (Malware Family) - win.medusalocker Malpedia (Fraunhofer FKIE)
- Cybereason vs. MedusaLocker Ransomware Cybereason
- MedusaLocker is Sweeping Its Gaze SonicWall