malware family

MedusaLocker

unknownentity:malware_familyransomware · 1 source

Observed as recently as May 2022, MedusaLocker actors predominantly rely on vulnerabilities in Remote Desktop Protocol (RDP) to access victims’ networks. The MedusaLocker actors encrypt the victim's data and leave a ransom note with communication instructions in every folder containing an encrypted file. The note directs victims to provide ransomware payments to a specific Bitcoin wallet address. MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed sp

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: medusalocker
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 814 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 627d603a-906f-4fbf-b922-f03eea4578fevia misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 814

MedusaLockerransomwarepayment
subjecttransaction99f139c5d4…8f8f910c70
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qy7ewkfpfr4x4rp39uwgsh2u698sl2uhfadqfyt · 984,771,982 sat · time 2022-10-13 10:16 UTC · url https://ransomwhe.re/#address/bc1qy7ewkfpfr4x4rp39uwgsh2u698sl2uhfadqfyt
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32317btcintel:annotations:32317@v3 sha256:8e3327ad40db10ad
confidencetrusted provider · 50
MedusaLockerransomwarepayment address
subjectaddressbc1qy7ewkfpfr4x4rp39uwgsh2u698sl2uhfadqfyt
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw MedusaLocker · url https://ransomwhe.re/#address/bc1qy7ewkfpfr4x4rp39uwgsh2u698sl2uhfadqfyt
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32316btcintel:annotations:32316@v2 sha256:856926d3500fed7d
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction5f33e51df6…fe3e67a8d2
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 13,494,000 sat · time 2021-03-25 21:57 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27014btcintel:annotations:27014@v3 sha256:0f0d2283b443bfc0
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction58c7da2ee9…516cbab81d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 85,000 sat · time 2021-03-30 02:05 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27013btcintel:annotations:27013@v3 sha256:5cd53d8967888eb9
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactionac3eea8160…54e5c960e9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 130,000,000 sat · time 2021-03-30 05:45 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27012btcintel:annotations:27012@v3 sha256:2748e3be5003d2f2
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactiona06513825c…df3dee98db
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 10,000,000 sat · time 2021-03-30 08:15 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27011btcintel:annotations:27011@v3 sha256:812126640e807091
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction395d018f4d…26d9a4ba51
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 3,990,213 sat · time 2021-03-31 08:00 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27010btcintel:annotations:27010@v3 sha256:1aeb2f3fad69dcee
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactionc139b0677a…5b7cc5760f
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 15,930,000 sat · time 2021-03-31 19:20 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27009btcintel:annotations:27009@v3 sha256:d6ff1762cb6cb78a
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction359a903cd5…d6da1dee5b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 20,000,000 sat · time 2021-04-01 00:32 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27008btcintel:annotations:27008@v3 sha256:e835ddb02c22d7f1
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactiona611c85611…d426a905a6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 8,583 sat · time 2021-04-01 18:25 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27007btcintel:annotations:27007@v3 sha256:244b8d4fd433bb68
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction9063408356…7b14d2d749
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 16,978,661 sat · time 2021-04-01 20:48 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27006btcintel:annotations:27006@v3 sha256:177617e263ce5198
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactionfe6cb989b6…85af4262ed
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 17,652,346 sat · time 2021-04-06 17:06 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27005btcintel:annotations:27005@v3 sha256:65560c90cd2be412
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction770debaa44…6af0af2468
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 3,000 sat · time 2021-04-08 01:56 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27004btcintel:annotations:27004@v3 sha256:3d6725c04e8fee0a
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactioneaca74d4a0…911d2ad182
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 12,000,000 sat · time 2021-04-08 12:47 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27003btcintel:annotations:27003@v3 sha256:7945bcd77e5f7e0a
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactionb74bee0b09…730614e4ee
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 40,000,000 sat · time 2021-04-08 15:37 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27002btcintel:annotations:27002@v3 sha256:69570e3879f3791d
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction278be8ad54…7594d1d11c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 15,000,000 sat · time 2021-04-08 19:02 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27001btcintel:annotations:27001@v3 sha256:33f29a3e872c4a60
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactiondd222d8621…06674d586e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 135,000 sat · time 2021-04-09 16:52 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27000btcintel:annotations:27000@v3 sha256:9b38dde1202f1214
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction641889d7f9…12ec2a7169
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 14,970,000 sat · time 2021-04-11 11:53 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26999btcintel:annotations:26999@v3 sha256:9933c372d3992fa3
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransaction857b49e261…ae18dce24e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 8,000,000 sat · time 2021-04-11 16:11 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26998btcintel:annotations:26998@v3 sha256:8975b389b47894df
confidencetrusted provider · 50
MedusaLockerransomwarepayment
subjecttransactiond23c808a62…d010047013
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidenceamount sat 19,850,000 sat · payment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 14,502,000 sat · payment 1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM · 5,348,000 sat · time 2021-04-12 12:43 UTC · url https://ransomwhe.re/#address/1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 6
ann_26996btcintel:annotations:26996@v6 sha256:4fca5cfce522b03c
confidencetrusted provider · 50

Subjects814 subjects carry a claim naming this entity · a sample

12xd6KrWVtgHEJHKPEfXwMVWuFK4k1FCUFaddress
14cATAzXwD7CQf35n8Ea5pKJPfhM6jEHakaddress
14oH2h12LvQ7BYBufcrY5vfKoCq2hTPoevaddress
184ZcAoxkvimvVZaj8jZFujC7EwR3BKWvfaddress
18wRbb94CjyTGkUp32ZM7krCYCB9MXUq42address
1AbRxRfP6yHePpi7jmDZkS4Mfpm1ZiatH5address
1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNMaddress
1BkmiGWPLum8MzusqZsq6Tn7v4oUjqPLjCaddress
1DeNHM2eTqHp5AszTsUiS4WDHWkGc5UxHfaddress
1DRxUFhvJjGUdojCzMWSLmwx7Qxn79XbJqaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.