Loading threat actor…
MedusaLocker is a ransomware threat actor associated with data-theft extortion and victim shaming through public leak postings. The actor has been linked to intrusions against organizations in multiple countries, including Germany, France, the United States, Brazil, Canada, and the United Arab Emirates. Observed victims span technology, telecommunications, manufacturing, business services, consumer services, and public-sector entities, indicating broad opportunistic targeting rather than a narrowly specialized vertical focus. Reported incidents include theft of victim email data in addition to ransomware deployment, consistent with extortion operations that rely on stolen information as leverage. MedusaLocker has also been associated with affiliate intrusions using the BYOVD-based security-disabling tool ThrottleBlood, indicating use of defense-evasion tooling intended to impair endpoint protection before ransomware execution. This supports assessment of capabilities in defense evasion and post-compromise data exfiltration. Public reporting and victim claims in the available evidence support MedusaLocker as a financially motivated ransomware actor, but do not provide high-confidence attribution to a specific state sponsor or country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack resulting in a data breach against Idex Group, with 30 emails reportedly extracted.
Conducting a ransomware attack resulting in a data breach against Twal Family IT Lab.
Conducting ransomware attacks against French municipal administrations, with victim advisories appearing under dual attribution and involving data theft from internal systems.
Mentioned only as another group associated with ThrottleBlood.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.