MedusaLocker — Ransomware Profile
MedusaLocker is a ransomware and data-extortion actor tracked by IntelFusions, linked to more than 25 victim listings published on data-leak sites during 2026. It is tracked separately from the Medusa ransomware-as-a-service operation.Also tracked as
BabyLockerKZ, AKO, AKO Doxware, MedusaReborn
IntelFusions coverage (1)
- Leak sites turn on Southeast Asia's listed companies 2026-09-03 · Cyber Incidents
Tools & malware
- Advanced IP Scanner Discovery/Network scanner
- Advanced Port Scanner Discovery/Network scanner
- Impacket Lateral movement
- Invoke-ReflectivePEInjection (PowerSploit) Loader/Code injection
- MedusaLocker Ransomware/Encryptor
- Mimikatz Credential theft
- PsExec Lateral movement
- SoftPerfect NetScan Discovery/Network scanner
Recent claimed victims
- Frisby Roofing (Frisby Construction LLC) 2026-09-12
- Abourametals 2026-09-12
- 瑞祥机电 (Ruixiang Jidian) 2026-09-12
- Praveg Caves Jawai 2026-09-12
- Licindia 2026-09-02
- Lawter 2026-09-01
- Jgsee 2026-08-27
- Servifruit 2026-08-27
- Hungry Lion 2026-08-27
- Qualisteel 2026-08-27
- Health 2026-08-27
- Twal Family IT Lab 2026-08-16
- All Parts Dry Cleaning 2026-08-16
- Idex Group 2026-08-16
- Bija Industrie 2026-08-16
- Thecourierguy 2026-08-16
- Forces 2026-07-07
- Dolrad 2026-07-01
- T Online 2026-07-01
- Bd 2026-07-01
- Penticton and District Society for Community Living 2026-07-01
- Sgs Gmbh 2026-07-01
- FunkeScheid 2026-07-01
- Estrela 2026-07-01
- Dadolighting 2026-07-01
Vendor research
- #StopRansomware: MedusaLocker (Joint Cybersecurity Advisory AA22-181A) FBI / CISA / Treasury / FinCEN
- MedusaLocker Ransomware: Encryption, Costs, and Protection SentinelOne
- MedusaLocker v3 Ransomware Explained: Technical Analysis, Tactics and Protection Cyderes
- Cybereason vs. MedusaLocker Ransomware Cybereason
- MedusaLocker is Sweeping Its Gaze SonicWall
- MedusaLocker (Malware Family) - win.medusalocker Malpedia (Fraunhofer FKIE)