- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Sources
- 1 source carries it
- Identifier
- GINC-APT-1196 · medusalocker-ransomware-actors
What it is
MedusaLocker is a ransomware-as-a-service ("RaaS") operation that has been active since September 2019. U.S. cybersecurity authorities indicate that MedusaLocker operators have primarily targeted victims in the healthcare sector, among other unspecified sectors. Initial access for MedusaLocker intrusions originally came via phishing and spam email campaigns, but since 2022 has typically occurred via exploit of vulnerable Remote Desktop Protocol devices.<sup>[HC3 Analyst Note MedusaLocker Ransomware February 2023]</sup>
This object represents behaviors associated with operators of MedusaLocker ransomware. As MedusaLocker is licensed on a RaaS model, affiliates likely do not act as a single cohesive unit, and behaviors observed during particular attacks may vary. Behaviors associated with samples of MedusaLocker ransomware are represented in the "MedusaLocker Ransomware" Software object.
**Malpedia (Research)**: https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- DesktopNow
- Remote Utilities
- RemoteCMD
- RemotePC
- Xploit