medusalocker

Ransomware
Sourceransomware.live

Vexday analysis

Operação de ransomware rastreada sob o nome MedusaLocker, com duas vítimas confirmadas no Brasil. A infraestrutura da ameaça é baseada em um bot escrito em .NET 2.0, utilizando HTTP como protocolo de comunicação com o servidor de comando e controle — uma evolução em relação à versão anterior, que fazia uso de IRC.

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Impact and victims

The group medusalocker has 3 known ransomware victims. See the most affected sectors and countries and recent victims.

3known victims
3in Brazil
2sectors hit
Activity (12 months)
05
07
Most attacked sectors
Retail & E-Commerce2
Agriculture and Food Production1
Most affected countries
🇧🇷 Brasil3
Recent victims
EstrelaRetail & E-Commerce · BR · 2026-07-01
Bandeirante SupermercadosRetail & E-Commerce · BR · 2026-05-05
CEAGESP / NetfeiraspAgriculture and Food Production · BR · 2026-05-05

medusalocker uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →