Medusalocker

Active

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

94 Victims

Nov 2, 2021 First Discovered

Sep 12, 2026 Last Discovered

4 Days Inactive

0% Infostealer

1/5 Sites Online

Known Locations (5)

File Manager

t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion

Human Verify

medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion

Ransomware blog – We will not give ourselves a name. Just watch out for the leakage of your data:)

z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion

Medusa Chat

95.143.191.148:3000

qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Tools Used

CredentialTheft

Invoke-TheHash, Mimikatz

DefenseEvasion

HRSword, PCHunter, ProcessHacker

DiscoveryEnum

Advanced IP Scanner, Advanced Port Scanner, SoftPerfect NetScan

LOLBAS

PsExec

Offsec

Impacket

RMM-Tools

Remote Desktop Plus (RDP+)

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (94)

Detailed victim list temporarily unavailable

This group has 94 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.