MedusaLocker
MedusaLocker is a Windows ransomware family, also referred to in the provided content as Medusa ransomware, though the content also explicitly notes that the newer Medusa/Spearwing operation is unrelated to the older MedusaLocker variant. MedusaLocker encrypts files using WinCrypt APIs, appearing to use AES for file encryption with the AES key protected by an embedded RSA-2048 public key. It skips certain extensions such as exe, dll, sys, ini, lnk, rdp, and already encrypted files, deletes restore points and shadow copies, disables Automatic Startup Repair, and repeatedly rescans systems after encryption to catch newly created unencrypted files. It attempts to access mapped network drives, shared network drives, and removable media, restarts the LanmanWorkstation service to ensure mapped drives are available, and reads or enables EnableLinkedConnections to reach shared network drives. Persistence behavior described in the content includes renaming itself to svchost.exe, copying itself to %APPDATA% as svchostt.exe, and creating startup registry entries; it also creates HKCU\Software\Medusa to track prior execution.
The malware attempts to terminate numerous security and business application processes, including sqlservr, sqlbrowser, tomcat6, httpd, java, winword, RTVscan, DefWatch, and QuickBooks-related processes. The content also associates MedusaLocker intrusions with broader defense-evasion tradecraft, including use of process-killing tools such as 0th3r_av5.exe and AV-killer payloads packed with HeartCrypt. One Kaspersky-described intrusion in Brazil involved attackers using valid RDP administrative credentials, Mimikatz, pass-the-hash via Invoke-WMIExec.ps1 and Invoke-SMBExec.ps1, and a BYOVD AV-killer named All.exe that loaded a renamed vulnerable TechPowerUp driver (ThrottleBlood.sys, originally ThrottleStop.sys; CVE-2025-7771) to terminate endpoint protections before deploying a MedusaLocker variant. The content also describes another case where a suspected zero-day RCE in SimpleHelp led to execution of an EDR-killer and then a Medusa ransomware payload.
The content links MedusaLocker activity to opportunistic access methods such as exposed or brute-forced RDP and notes attacker tooling found in related incidents including Mimikatz, Advanced Port Scanner, NetworkShare.exe, PsExec.exe, PsExec64.exe, and batch files. A known UAC bypass involving cmstplua.dll and CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} is described, along with another observed CLSID {8761ABBD-7F85-42EE-B272-A76179687C63}. The ransom note is described as HOW_TO_OPEN_FILES.html, with contact addresses including mrromber@cock.li and mrromber@tutanota.com; additional associated addresses mentioned in the content include ctorsenoria@tutanota.com, folieloi@protonmail.com, sambolero@tutanoa.com, rightcheck@cock.li, fartcool@protonmail.ch, bestcool@keemail.me, tanoss@protonmail.com, and sypress@protonmail.com. Sample and build artifacts directly mentioned include medusa.exe (SHA-256 3a5b015655f3aad4b4fd647aa34fda4ce784d75a20d12a73f8dc0e0d866e7e01), dix_16.exe (SHA-256 49da42d00cc3ad6379ead2e07fd5f09bd358b144a6e78aad4bb1a8298e2bb568), dix_16_xp.exe (SHA-256 6c7eda3f5e9bbc685b0eefde2a51f0ccb06ad33805e617876a5124410cac9945), and an embedded PDB path: C:\Users\Gh0St\Desktop\MedusaLockerInfo\MedusaLockerProject\MedusaLocker\Release\MedusaLocker.pdb.
The content further notes that MedusaLocker samples and related tooling have been observed in HeartCrypt-packed campaigns and that over 350 new ransomware strains discovered in 2025 were reportedly based largely on MedusaLocker, Chaos, and Makop families, indicating substantial code reuse or derivative activity in the ransomware ecosystem.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The vulnerability in ThrottleStop.sys has been assigned CVE-2025-7771. According to our information, the vendor is currently preparing a patch.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...web server exploitation campaigns in 2020 that primarily delivered MedusaLocker ransomware."
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
“MEDUSALOCKER… Persistence is established using a scheduled task.” and “Scheduled Task/Job (T1053) · Scheduled Task (T1053.005)”
Persistence
3 techniques
Persistence
“MEDUSALOCKER… Persistence is established using a scheduled task.” and “Scheduled Task/Job (T1053) · Scheduled Task (T1053.005)”
Privilege Escalation
3 techniques
Privilege Escalation
“MEDUSALOCKER… Persistence is established using a scheduled task.” and “Scheduled Task/Job (T1053) · Scheduled Task (T1053.005)”
Stealth
4 techniques
Stealth
“AVADDON, ThunderX and RANZY have different implementations to obfuscate both the RSA key and the strings.”
After the "Adding to Autoload" debug message it will rename itself to svchost.exe ... It also copies itself to %APPDATA% after renaming to executable to "svchostt.exe".
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
MedusaLocker will try to terminate the following processes by their name. The List contains Security Software as well as Services commonly used in productive environments such as SQL or Webservers.
Lateral Movement
1 technique
Lateral Movement
Command and Control
1 technique
Command and Control
Impact
3 techniques
Impact
Since early 2023, AvNeutralizer has been used in numerous intrusions, including with the subsequent deployment of well-known ransomware strains such as AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit.
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A distinct ransomware family/group referenced for comparison, described as relying more on opportunistic access methods such as RDP brute force.
Ransomware family associated with use of the process-killing tool 0th3r_av5.exe to shut down antivirus monitoring.
Ransomware family mentioned in connection with campaigns that weaponize legitimate Windows utilities to dismantle defenses before payload execution.
"Medusa ransomware should not be confused with other similarly named malware, such as ... MedusaLocker ransomware."
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.