MedusaLockerMalware
- ako doxware
- ako ransomware
A Windows ransomware that will run certain tasks to prepare the target system for the encryption of files. MedusaLocker avoids executable files, probably to avoid rendering the targeted system unusable for paying the ransom. It uses a combination of AES and RSA-2048, and reportedly appends extensions such as.encrypted,.bomber,.boroff,.breakingbad,.locker16,.newlock,.nlocker, and.skynet.From MISP Galaxy
Last reported 13 days ago, by AhnLab ASEC5 reports
ATT&CK techniques
6 of 22 · each with the sentence it comes from- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
- T1543Create or Modify System Process
“Create or Modify System Process: Windows Service”
- T1543.003Windows Service
“T1543.003”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on Ransomware“…시아 일본 캐나다 탄자니아 영국 에콰도르 에티오피아 헝가리 사우디아라비아 프랑스 한국 아르헨티나 필리핀 앙골라 싱가포르 Japan kazu KillSec KryBit LockBit logistics Malaysia Manufacturing MedusaLocker MetaEncryptor Myanmar namibia norway Panzer Peru Philippines PwnForums Qilin RaaS RansomHouse Ransomware Rehub Rhysida Safepay Saudi-…”
-
GentleKiller: análisis del framework EDR killer de Gentlemen“Este EDR killer ha sido observado repetidamente en intrusiones llevadas a cabo por afiliados de MedusaLocker y, con menor frecuencia, por afiliados de DragonForce.”
-
Killing me gently: Inside Gentlemen’s EDR killer framework“This EDR killer has been repeatedly observed in intrusions carried out by MedusaLocker affiliates, and, less frequently, by DragonForce affiliates.”
-
EDR killers explicados: Más allá de los drivers“La telemetría de ESET coincide con estos hallazgos y muestra adicionalmente su despliegue durante incidentes de MedusaLocker.”
-
EDR killers explained: Beyond the drivers“ESET telemetry aligns with these findings and additionally shows deployment during MedusaLocker incidents.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 4 reports
- 8ae6bd18b129061f…84cf0383c75din 2 reports
- ba914fe77b177b45…4765c510a074in 2 reports
- d605994fc72a2bb5…b9170eca73a2in 2 reports
- b0b912a3fd1c05d7…2880004021a1in 2 reports
- 5aa3124e5c4921e5…71da21b07da3in 2 reports
- 7556ae58c215b824…6c7a8f0fdd1ain 2 reports
- 331879f5eec8892b…1bad0bf63bd6in 2 reports
- f11aebccb9a86a7e…697f233c255fin 2 reports
- ef9cd06683159397…4e6eaad96ebain 2 reports
- 711ef22152699703…47c91680bbe2in 2 reports
- 68fec379f2ae76c3…50cea1d06990in 2 reports
- a11ee9cdc59e5caa…104f3ad68e62in 2 reports
- 96f0dbf52aed0afd…04b674f7358ein 2 reports
- 2f86898528c6cab3…a0c029b73950in 2 reports
- 9ad51ad97c01e97a…785e0f6320a8in 2 reports
- a19117175dbc9ba4…e299a2e32192in 2 reports
- 12500f6c87ce6271…468d15c14223in 2 reports
- d29670e684e40ddc…bc96737035b6in 2 reports
- 56bee9df5833a637…98b0812fe643in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.