Medusalocker

Inactive

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

103 Victims

Nov 2, 2021 First Discovered

Oct 5, 2026 Last Discovered

26 Days Inactive

0% Infostealer

0/5 Sites Online

Known Locations (5)

Human Verify

medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion

qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

File Manager

t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion

Ransomware blog – We will not give ourselves a name. Just watch out for the leakage of your data:)

z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion

Medusa Chat

95.143.191.148:3000

Tools Used

CredentialTheft

Invoke-TheHash, Mimikatz

DefenseEvasion

HRSword, PCHunter, ProcessHacker

DiscoveryEnum

Advanced IP Scanner, Advanced Port Scanner, SoftPerfect NetScan

LOLBAS

PsExec

Offsec

Impacket

RMM-Tools

Remote Desktop Plus (RDP+)

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (103)

Detailed victim list temporarily unavailable

This group has 103 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.