Back to Threat Groups

medusalocker

ACTIVE

ransomware group

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

Victims
99
records
First Discovered
Nov 15, 2022
victim
Last Discovered
Sep 28, 2026
victim
Inactive Since
2
days
Countries
27
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
1
Nov
2025
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
16
May
2026
Jun
2026
10
Jul
2026
10
Aug
2026
13
Sep
2026
Oct
2026

Victims (99)

PKSF — Palli Karma-Sahayak Foundation

medusalocker🇧🇩 BD
2d ago

Organization with 13 emails extracted. Domain: 08trl.exit

Finance3.0Published
08trl.exit

Juntadeandalucia

medusalocker🇪🇸 ES
2d ago

Organization with 198 emails extracted. Domain: juntadeandalucia.es

Government5.5Published
juntadeandalucia.es

Premiumfruits

medusalocker🇪🇸 ES
2d ago

Organization with 3292 emails extracted. Domain: premiumfruits.eu

Agriculture and Food Production5.5Published
premiumfruits.eu

ATCO Ltd

medusalocker🇨🇦 CA
2d ago

Organization with 80 emails extracted. Domain: mail.gmail.com

Energy & Utilities3.0Published
mail.gmail.com

Aokkef

medusalocker🇫🇷 FR
7d ago

Organization with 137 emails extracted. Domain: aokkef.fr

3.0Published
aokkef.fr

Seznam

medusalocker🇨🇿 CZ
7d ago

Organization with 115 emails extracted. Domain: seznam.cz

Technology3.0Published
seznam.cz

Abv

medusalocker🇧🇬 BG
7d ago

Organization with 583 emails extracted. Domain: abv.bg | Sofia, Bulgaria

Technology5.5Published
abv.bg

瑞祥机电 (Ruixiang Jidian)

medusalocker🇨🇳 CN
18d ago

Elevator manufacturer, brand 银海 (Yinhai). Produces machine-room-less (MRL) passenger elevators and OEMs elevator components (car top/bottom, car wall panels, CO...

Manufacturing1.0Published

Abourametals

medusalocker🇦🇪 AE
18d ago

Organization with 25448 emails extracted. Domain: abourametals.com

Manufacturing1.0Published
abourametals.com

Frisby Roofing (Frisby Construction LLC)

medusalocker🇺🇸 US
18d ago

Residential roofing contractor (family-owned, locally operated). Complete roof tear-off and replacement, dimensional shingles (CertainTeed, Tamko Heritage, GAF)...

Other2.0Published
frisbyconstruction.com

Praveg Caves Jawai

medusalocker🇮🇳 IN
18d ago

Luxury safari resort near Jawai leopard reserve, Sumerpur (Pali), Rajasthan, India (phone +91 777 908 4007). Runs IDS Fortune V5 hotel PMS/POS (customer code 94...

Hospitality1.0Published
swiftbook.io

Licindia

medusalocker🇮🇳 IN
28d ago

Organization with 9 emails extracted. Domain: licindia.com

Other2.0Published
licindia.com

Lawter

medusalocker🇺🇸 US
29d ago

Organization with 150 emails extracted. Domain: lawter.com

Manufacturing1.0Published
lawter.com

Jgsee

medusalocker🇹🇭 TH
Aug 27, 2026

Organization with 4 emails extracted. Domain: jgsee.kmutt.ac.th

1.0Published
jgsee.kmutt.ac.th

Servifruit

medusalocker🇲🇽 MX
Aug 27, 2026

Organization with 195 emails extracted. Domain: servifruit.com

Agriculture and Food Production1.0Published
servifruit.com

Hungry Lion

medusalocker🇬🇭 GH
Aug 27, 2026

Fast food franchise (burgers, chicken, chips, ice cream) - 111 locations across South Africa, Botswana, Namibia, Zambia, Zimbabwe, Lesotho, Mauritius. Three POS...

Retail & E-Commerce242 MB1.0Published

Qualisteel

medusalocker
Aug 27, 2026

Organization with 7568 emails extracted. Domain: qualisteel.com

Manufacturing1.0Published
qualisteel.com

Health

medusalocker🇦🇺 AU
Aug 27, 2026

Organization with 103 emails extracted. Domain: health.nsw.gov.au

Healthcare1.0Published
health.nsw.gov.au

Twal Family IT Lab

medusalocker
Aug 16, 2026

Personal IT home lab. AD domain: twalfamily.com. VMware vSphere, multiple AD domains. Daniel Al Twal works at Technology North Corp (Edmonton), former DND co-op...

Technology1.0Published
twalfamily.com

All Parts Dry Cleaning

medusalocker🇬🇧 GB
Aug 16, 2026

Dry cleaning & laundry. Domain: allpartsdrycleaning.co.uk. | United Kingdom

Retail & E-Commerce1.0Published
allpartsdrycleaning.co.uk

Idex Group

medusalocker🇩🇪 DE
Aug 16, 2026

Organization with 30 emails extracted. Domain: idex-group.com

Technology1.0Published
idex-group.com

Bija Industrie

medusalocker🇫🇷 FR
Aug 16, 2026

Organization with 693 emails extracted. Domain: bija-industrie.com

Manufacturing1.0Published
bija-industrie.com

Thecourierguy

medusalocker🇿🇦 ZA
Aug 16, 2026

Organization with 2018 emails extracted. Domain: thecourierguy.co.za

Transportation1.0Published
thecourierguy.co.za

Forces

medusalocker🇨🇦 CA
Jul 7, 2026

Organization with 28 emails extracted. Domain: ***.gc.ca

Government & Defense1.0Published
forces.gc.ca

Estrela

medusalocker🇧🇷 BR
Jul 1, 2026

Organization with 11 emails extracted. Domain: estrela.ind

Retail & E-Commerce1.0Published
estrela.ind

Karneslegal

medusalocker
Jul 1, 2026

Organization with 23 emails extracted. Domain: karneslegal.com

Professional Services1.0Published
karneslegal.com

Sgs Gmbh

medusalocker🇩🇪 DE
Jul 1, 2026

Organization with 933 emails extracted. Domain: sgs-gmbh.com

Professional Services1.0Published
sgs-gmbh.com

Dadolighting

medusalocker🇺🇸 US
Jul 1, 2026

Organization with 17 emails extracted. Domain: dadolighting.com

Technology1.0Published
dadolighting.com

T Online

medusalocker🇩🇪 DE
Jul 1, 2026

Organization with 823 emails extracted. Domain: t-online.de

Technology1.0Published
t-online.de

FunkeScheid

medusalocker🇩🇪 DE
Jul 1, 2026

Notarkanzlei FunkeScheid, Kanzlei im Ostend, Frankfurt. 9755 emails. AD: Kanzlei.FunkeScheid.com

Legal1.0Published
funkescheid.com

Mairie Thiverval Grignon

medusalocker🇫🇷 FR
Jul 1, 2026

Organization with 162 emails extracted. Domain: mairie-thiverval-grignon.fr

Government1.0Published
mairie-thiverval-grignon.fr

Dolrad

medusalocker🇦🇪 AE
Jul 1, 2026

Organization with 69 emails extracted. Domain: dolrad.ae

Other1.0Published
dolrad.ae

Penticton and District Society for Community Living

medusalocker🇨🇦 CA
Jul 1, 2026

Canadian charity providing disability-related services. CRA Registration: 119090686RR0001 | Penticton, British Columbia, Canada

Government & Defense1.0Published
pdscl.org

Elken Sdn Bhd

medusalocker🇲🇾 MY
May 5, 2026

MLM / health & beauty products company. ~16k emails extracted.

Consumer Services1.0Published
elken.com

Bandeirante Supermercados

medusalocker🇧🇷 BR
May 5, 2026

Brazilian supermarket chain.

Consumer Services1.0Published
bandeirantesupermercados.com.br

Strategic Imports

medusalocker🇦🇺 AU
May 5, 2026

Australian auto parts/batteries importer. Brands: Strategic Imports, Auto Parts Now, Discount Batteries Now. User: bstuart (Brad Stuart). QNAP NAS (CACHEDEV1_DA...

Business Services1.0Published

Magnolia (Israel)

medusalocker🇮🇱 IL
May 5, 2026

Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sells via buyme.co.il gift cards. ~38k files, invoices in Hebre...

Retail & E-Commerce1.0Published
buyme.co.il

Trimble Inc / Gerrard Inc

medusalocker🇺🇸 US
May 5, 2026

Technology company Trimble (trimble.com) and Gerrard Inc (gerrardinc.com). ~18 Trimble email addresses.

Technology1.0Published
trimble.com

Atencio Engineering

medusalocker🇺🇸 US
May 5, 2026

Civil engineering & land surveying firm. Services: site plans, boundary surveys, OWTS (septic) design, fire line design, elevation certificates, flood plain ana...

Construction1.0Published
atencioengineering.com

SIT Group / Robusta

medusalocker🇮🇹 IT
May 5, 2026

Italian company SIT Group (sitgroup.it) and Bulgarian Robusta (robusta.bg). Also abv.bg emails.

Business Services1.0Published
sitgroup.it

Desert Christian Schools

medusalocker🇺🇸 US
May 5, 2026

K-12 Christian school affiliated with First Baptist Church of Lancaster, CA. ADP payroll, DCFS childcare program, City of Lancaster Water Safety program. Financ...

Education1.0Published

CourtSmart

medusalocker🇺🇸 US
May 5, 2026

Court technology company. Domain courtsmart.com / COURTSMART2. Dev server: dev-rich20.courtsmart.com. Connections to JIS.org, nashville.org.

Business Services1.0Published
courtsmart.com

Hathcock (Personal)

medusalocker
May 5, 2026

Personal comprehensive reports. Individuals: Noel Ray Hathcock, Trinity John Hathcock.

1.0Published

ActionAid / TACOSA

medusalocker🇬🇧 GB
May 5, 2026

NGO sector. Domains: actionaid.org, tacosa.org.za, immigration.go.tz.

Public Sector1.0Published
actionaid.org

Palmers Relocations

medusalocker🇬🇧 GB
May 5, 2026

Australian international removals & relocation company. FIDI accredited, ISO 9001:2015 certified. Services: household moves, storage, customs, immigration (IMMI...

Transportation/Logistics1.0Published

Académie de Montpellier / CSJM

medusalocker🇫🇷 FR
May 5, 2026

French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff ...

Education1.0Published
csjm.beziers

Colegio María Inmaculada

medusalocker🇨🇷 CR
May 5, 2026

Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2.

Education1.0Published
mariainmaculada.ed.cr

CEAGESP / Netfeirasp

medusalocker🇧🇷 BR
May 5, 2026

Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts.

Agriculture and Food Production1.0Published
netfeirasp.ceagesp

Raycolighting

medusalocker🇬🇧 GB
May 5, 2026

Organization with 2 emails extracted. Domain: raycolighting.com

Manufacturing1.0Published
raycolighting.com

dulay.ca

medusalocker🇨🇦 CA
Nov 18, 2025

Price-$40000 (sale in one hand there are options for making a profit from these files will be included in the deal) 500Gb

Technology500 GB3.0Published
dulay.ca

Infrastructure

external-feed-candidate
ONLINE
http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/

886ms

19m ago

leak site
OFFLINE

unreachable

https://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

3124ms

3h ago

leak site
OFFLINE

unreachable

http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/

2637ms

3h ago

external-feed-candidate
OFFLINE

unreachable

http://z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion/

2597ms

3h ago