Classification: TLP:CLEAR | Publication Date: 2026-11-05 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

MEDUSALOCKER Leak-Site Surge: 18 New Claimed Victims Posted in One Day

Executive Summary

On 2026-11-04, MEDUSALOCKER posted 18 new entries to its dark web leak site in a single 24-hour window — one of the heaviest single-day publishing bursts we have tracked from this operation in recent months. The listed organizations span Technology, Manufacturing, Professional Services, Education, Retail & E-Commerce, and Transportation, with a geographic spread covering the United States, Colombia, India, the United Kingdom, Canada, Switzerland, Brazil, and South Africa.

Every claim in this batch is single-source only: none of the 18 postings were independently observed by a second leak-site crawler, and no tier of this data confirms that any breach occurred. These are accusations by a criminal operation. Enterprise defenders in the named sectors should nonetheless treat this burst as a signal of active MEDUSALOCKER intrusion tooling in circulation and validate the detection content below against their environments — particularly organizations operating exposed RDP, unpatched remote access infrastructure, or flat internal networks.

Sourcing & Verification

• 0 of 18 listings in this dataset were independently observed by a second leak-site crawler. 18 of 18 appear on a single source only (ransomware.live monitoring of the gang's .onion site). Of the 18 postings counted, 15 were enumerated with named organizations in this pull.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in our data — including multi-source observation — confirms that an intrusion, encryption event, or data theft actually occurred. Only the organization itself or its regulator can confirm that.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, not every incident is legally reportable, and neither silence nor denial settles the question. We report what the gang publishes, no more.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — MEDUSALOCKER

Aliases: Medusa Locker, Medusa ransomware (note: historically reported as a distinct operation from the separate "Medusa" group that emerged later; track infrastructure, not just naming, to avoid conflation).

Operating model: MEDUSALOCKER has operated since roughly 2019 as a closed or tightly controlled operation rather than a broadly advertised RaaS. While it has recruited affiliates at times, it does not run the open affiliate portals typical of LockBit or BlackCat. Victimology and tooling consistency across years of activity suggest a small core operator set.

Ransom demands: Historically variable and sized to the target — from tens of thousands of dollars against SMBs to low-seven-figure demands against mid-market enterprises. Demands are typically per-victim negotiated rather than fixed-price.

Initial access methods (historical, gang-level TTPs — not tied to any specific named victim below):

• RDP brute force / exposed RDP exploitation — the gang's most consistently documented entry vector
• Phishing with malicious attachments (macro-enabled documents, malicious links)
• Exploitation of internet-facing remote access infrastructure

Extortion model: Double extortion. Data is exfiltrated before encryption; victims who refuse to pay are named on the .onion leak site with staged data release threats. A leak-site posting therefore implies the actor claims to hold stolen data — which is why these postings matter even when unverified.

Dwell time: Observed dwell times in documented MEDUSALOCKER incidents have ranged from same-day detonation after access to several days of reconnaissance and staging. The gang favors quiet enumeration, disabling of backups and security tooling, then rapid enterprise-wide encryption — frequently via batch scripts pushed over PsExec/WMI or Group Policy in domain environments.

Encryption-time behavior worth detecting: deletion of Volume Shadow Copies (vssadmin delete shadows), termination of backup/database/security services, forced release of file locks (RestartManager abuse is a long-standing MedusaLocker hallmark), and a Recovery_Instructions / How_to_back_files-style ransom note dropped alongside encrypted files.

Current Campaign Analysis

Sector targeting (from leak-site postings)

The mix is classic MEDUSALOCKER opportunism: no single-sector focus, heavy representation of mid-market firms, and meaningful manufacturing and technology weighting — sectors where operational downtime pressure increases payment likelihood.

Geographic concentration

US, CO, IN, GB, CA, CH, BR, ZA. The United States leads identified countries, but the batch is genuinely global — consistent with an access-vector-driven (not target-list-driven) operation: whoever has an exposed, brute-forceable or phishable perimeter gets listed.

Victim profile

The named organizations skew toward SMB and mid-market enterprises — manufacturing firms, a law practice, a staffing/recruiting firm, a university. Estimated revenue ranges, inferred from sector and typical gang victimology, run from low single-digit millions to low hundreds of millions USD. Notably, the listing of Ulaval (Education, CA) follows the gang's intermittent interest in higher-education targets, where large personal-data holdings raise extortion leverage.

Posting frequency / escalation

All 18 postings carry a 2026-11-04 publication date. A single-day batch of this size typically indicates one of two things: (a) a backlog of intrusions published together to create pressure optics, or (b) a genuinely parallel intrusion tempo enabled by commodity access. Either way, a burst of this volume suggests the operation is actively scaling output, and defenders should expect continued postings through November.

CVE exposure — hypothesis only

We have no evidence linking any specific CVE to any specific named listing above. However, MEDUSALOCKER's documented reliance on internet-facing infrastructure makes the following CISA KEV entries (all confirmed ransomware-exploited) directly relevant sector-level exposure that defenders in the targeted sectors should treat as priority patch items:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise is a force multiplier for any ransomware crew: hypervisor-level encryption.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08). VPN-edge authentication bypass maps directly onto the gang's remote-access entry preference.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Management-plane compromise of perimeter firewalls.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05). CI/CD servers are high-value staging points for supply-chain-adjacent lateral movement — relevant to the Technology-sector listings.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer-workstation supply chain exposure, again relevant to technology firms.

Treat these as hypothesized access surface, not attribution.

Detection Engineering

The following content targets MEDUSALOCKER's documented playbook: RDP-based access, backup/security service destruction, shadow copy deletion, and PsExec/WMI-style mass deployment prior to encryption.

---
title: Volume Shadow Copy Deletion via vssadmin/wmic - MedusaLocker Pre-Encryption Behavior
id: 8f3a2c11-ml01-4b7d-9e2a-medusa000001
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies, a consistent MEDUSALOCKER pre-encryption step (T1490 Inhibit System Recovery).
author: Security Arsenal Threat Intelligence
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_cmd:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
      - 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'
      - 'Get-WmiObject Win32_Shadowcopy'
  filter_legit:
    CommandLine|contains:
      - 'Veeam'
      - 'backupExec'
  condition: selection_cmd and not filter_legit
falsepositives:
  - Legitimate backup software maintenance windows
tags:
  - attack.impact
  - attack.t1490
---
title: Mass Termination of Backup Database and Security Services - MedusaLocker T1489
id: 8f3a2c11-ml02-4b7d-9e2a-medusa000002
status: experimental
description: Detects net stop / sc / taskkill usage against backup, database, AV and EDR services, a documented MEDUSALOCKER step before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
      - '\taskkill.exe'
  selection_svc:
    CommandLine|contains:
      - 'stop '
      - 'config '
      - '/f /im'
  selection_targets:
    CommandLine|contains:
      - 'veeam'
      - 'backup'
      - 'vss'
      - 'sql'
      - 'mssql'
      - 'exchange'
      - 'sophos'
      - 'defender'
      - 'sentinel'
      - 'carbonblack'
      - 'crowdstrike'
  condition: selection_img and selection_svc and selection_targets
falsepositives:
  - Administrative maintenance scripts; baseline by service account and host
tags:
  - attack.impact
  - attack.t1489
---
title: Remote Service Creation Consistent with PsExec-Style Mass Deployment - MedusaLocker Lateral Movement
id: 8f3a2c11-ml03-4b7d-9e2a-medusa000003
status: experimental
description: Detects remote service installation (Event 7045) with PsExec-like or randomized service names on servers, consistent with MEDUSALOCKER batch-script ransomware push (T1021.002 / T1569.002).
author: Security Arsenal Threat Intelligence
date: 2026/11/05
logsource:
  product: windows
  service: system
level: critical
detection:
  selection:
    EventID: 7045
  selection_name:
    Service_Name|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexecsvc'
  condition: selection and selection_name
falsepositives:
  - Legitimate administrative use of PsExec; alert on source host and account context
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002

// Security Arsenal — MEDUSALOCKER pre-ransomware staging hunt (Microsoft Sentinel / Defender XDR)
// Looks for the gang's typical kill-chain footprint in the 48h before encryption:
// backup/service destruction + shadow deletion + remote execution artifacts, correlated per device.
let lookback = 7d;
let SuspiciousStaging =
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows", "shadowcopy delete", "recoveryenabled no",
    "net stop", "sc config", "taskkill /f")
   or FileName in~ ("psexec.exe", "psexesvc.exe", "paexec.exe")
| extend Indicator = case(
    ProcessCommandLine has "shadow", "ShadowCopyDeletion",
    ProcessCommandLine has_any ("net stop", "sc config"), "ServiceDisruption",
    "PsExecStyleExec")
| summarize Indicators = make_set(Indicator), IndicatorCount = dcount(Indicator),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Commands = make_set(ProcessCommandLine, 20)
    by DeviceName, InitiatingProcessAccountName
| where IndicatorCount >= 2;   // multiple distinct staging behaviors on one host = escalate
SuspiciousStaging
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(lookback)
    | where RemotePort == 3389 or LocalPort == 3389
    | summarize RDPConnections = count(), RDPPeers = make_set(RemoteIP, 10) by DeviceName
) on DeviceName
| project DeviceName, InitiatingProcessAccountName, IndicatorCount, Indicators, FirstSeen, LastSeen, RDPConnections, RDPPeers
| order by IndicatorCount desc;

# Security Arsenal — Rapid MEDUSALOCKER Exposure & Staging Check (run as admin, per host or via your RMM)
# Checks: (1) RDP exposure, (2) scheduled tasks created in last 7 days, (3) shadow copy health, (4) recent suspicious service installs.

Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Host "RDP Enabled: $rdpEnabled | Port: $rdpPort | NLA Enforced: $nla"
if ($rdpEnabled -and $nla -eq 0) { Write-Host "[!] RISK: RDP enabled WITHOUT Network Level Authentication (MedusaLocker brute-force target)" -ForegroundColor Red }

Write-Host "`n=== [2] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{n='Author';e={$_.Author}} | Format-Table -AutoSize

Write-Host "`n=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
else { Write-Host "[!] WARNING: No shadow copies present — verify this was not deleted (vssadmin delete shadows is a MedusaLocker hallmark)" -ForegroundColor Red }

Write-Host "`n=== [4] Services Installed in Last 7 Days (Event 7045) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Path';e={$_.Properties[1].Value}} | Format-Table -AutoSize

Write-Host "`nDone. Investigate any unexpected entries above against change-control records." -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (pre-encryption)

1. Shadow copy deletion events (vssadmin, wmic shadowcopy delete) — MEDUSALOCKER's most reliable pre-detonation tell.
2. Mass service stops on backup (Veeam, Windows Backup), database (MSSQL, Exchange), and security agents.
3. PsExec/WMI service creation (Event 7045) appearing simultaneously across multiple servers — the gang pushes encryption via batch scripts at scale.
4. New scheduled tasks on servers, especially tasks invoking scripts from C:\Users\Public or C:\ProgramData.
5. Abnormal RDP logon bursts (Event 4625 volume followed by 4624 type 3/10) from unfamiliar source IPs or accounts.
6. Large outbound transfers to cloud storage or unknown endpoints in the days before any alert — exfil precedes the leak-site posting.

Assets this gang historically prioritizes for exfiltration

• Finance and accounting data (invoices, payroll, banking details)
• HR records and PII — high extortion leverage, especially for the education-sector listings
• Legal/client files — directly relevant to the Professional Services listings (e.g., the law-practice claim)
• Engineering/CAD and IP from manufacturing victims
• Customer databases and credentials stores

Containment actions, ordered by urgency

1. Isolate affected segments immediately — kill switch/RDP access at the perimeter; block outbound to unknown IPs.
2. Disable compromised accounts and force enterprise-wide credential reset, prioritizing domain admins and service accounts.
3. Halt PsExec/WMI/WinRM where operationally tolerable to break mass-deployment capability.
4. Protect backups: verify offline/immutable copies are intact before any remediation wipes evidence.
5. Preserve artifacts: memory captures and logs from the first-alerted host; MedusaLocker staging often survives on adjacent machines.
6. Engage counsel and IR retainer before any communication with the actor; leak-site listing means the actor claims to hold data — assume a disclosure decision is coming.

Hardening Recommendations

Immediate (24 hours)

• Kill or gate RDP: no direct internet exposure; VPN + MFA in front, NLA enforced, account lockout policies tuned against brute force. This single control addresses MEDUSALOCKER's most documented entry vector.
• Patch the KEV edge stack: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310) — in that order of perimeter criticality.
• Block macro execution from internet-sourced Office documents via GPO; enable Attack Surface Reduction rules for Office child processes.
• Deploy the Sigma rules above and validate 7045/vssadmin alerting fires in your SIEM.
• Verify shadow copies exist and are protected on file servers; restrict vssadmin to break-glass accounts.

Short-term (2 weeks)

• Segment backups off the production domain with immutable, credentialed-separately storage; MEDUSALOCKER explicitly hunts reachable backup infrastructure.
• Deploy application control (WDAC/AppLocker) blocking unsigned binaries in C:\Users\Public and C:\ProgramData on servers.
• Tier administrative access: no domain-admin logons to workstations; dedicated PAWs for server administration to blunt WMI/PsExec pivot value.
• Egress monitoring with alerting on >baseline outbound volume per host — catch exfil before the leak site does.
• Patch CI/CD and developer tooling (TeamCity — CVE-2026-63077; audit Nx Console versions — CVE-2026-48027) for technology-sector organizations, and hunt for persistence on build servers.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub