MEDUSALOCKER Ransomware Gang: 5 New Victims Posted — Cross-Sector Extortion Wave & Detection Rules

---
title: MedusaLocker Pre-Ransomware Staging and Shadow Copy Tampering
id: 7f4a2c10-6c2d-4d59-9d1b-medusalocker0001
status: experimental
description: Detects suspicious pre-encryption behavior often seen before MedusaLocker-style detonation: shadow copy deletion, backup catalog tampering, mass file rename/encryption entropy, or archive staging shortly before ransomware notes appear.
author: Security Arsenal Threat Intelligence
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/tactics/TA0040/
  - https://attack.mitre.org/techniques/T1490/
date: 2026/08/29
modified: 2026/08/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' a -r'
      - ' -mx'
      - 'Compress-Archive'
      - ' -p'
      - ' -hp'
  condition: 1 of selection_*
falsepositives:
  - Enterprise backup jobs, endpoint backup troubleshooting, legitimate compression by software packaging
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560
  - medusalocker
---
title: MedusaLocker Initial Access via Edge VPN Remote Support or RDP Anomaly
id: 7f4a2c10-6c2d-4d59-9d1b-medusalocker0002
status: experimental
description: Detects suspicious remote access patterns consistent with ransomware initial access: RDP logons from rare external IPs, new local admin creation after remote logon, or execution from remote support tooling paths after Check Point/ScreenConnect exposure.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1133/
  - https://attack.mitre.org/techniques/T1021/001/
  - https://attack.mitre.org/techniques/T1219/
date: 2026/08/29
modified: 2026/08/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\rclone.exe'
    CommandLine|contains:
      - ' -silent'
      - ' -quiet'
      - ' copy'
      - ' config create'
  selection_admin:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\powershell.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - ' localgroup administrators'
      - ' /add'
      - ' New-LocalUser'
      - ' Add-LocalGroupMember'
  filter_known_admin_hosts:
    Computer|startswith:
      - 'IT-'
      - 'ADM-'
  condition: (selection_rmm or selection_admin) and not filter_known_admin_hosts
falsepositives:
  - Approved remote support sessions, helpdesk admin creation, managed file sync
level: medium
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1133
  - attack.t1219
  - medusalocker
---
title: MedusaLocker Lateral Movement with PsExec WMI or Service Creation
id: 7f4a2c10-6c2d-4d59-9d1b-medusalocker0003
status: experimental
description: Detects common ransomware lateral movement primitives used before enterprise-wide encryption: remote service creation, PsExec-style ADMIN$ writes, WMI process launch and Cobalt Strike-like named pipe service artifacts.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1569/002/
date: 2026/08/29
modified: 2026/08/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\csexec.exe'
      - '\paexec.exe'
  selection_wmi:
    Image|endswith:
      - '\wmic.exe'
      - '\wmiprvse.exe'
    CommandLine|contains:
      - ' process call create'
      - ' /node:'
      - ' Invoke-CimMethod'
      - ' Win32_Process'
  selection_service:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - ' create '
      - ' binpath='
      - ' start= auto'
      - ' New-Service'
  condition: 1 of selection_*
falsepositives:
  - SCCM/Intune software deployment, administrative remote execution from approved jump hosts
level: high
tags:
  - attack.lateral_movement
  - attack.execution
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
  - medusalocker

let lookback = 14d;
let suspicious_rmm = dynamic(["screenconnect", "anydesk", "teamviewer", "rclone", "psexec", "paexec", "csexec"]);
let staging_terms = dynamic(["delete shadows", "resize shadowstorage", "delete catalog", "recoveryenabled no", "bootstatuspolicy ignoreallfailures", "compress-archive", "rar.exe", "7z.exe", " -hp", "copy --", "mega", "temp\", "programdata\"]);
union withsource=tableName (
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where FileName has_any (suspicious_rmm) or ProcessCommandLine has_any (staging_terms)
  | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where RemotePort in (3389, 5985, 5986, 445, 22) or RemoteUrl has_any (dynamic(["mega", "transfer", "sendspace", "anonfiles", "gofile"]))
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
),
(
  SigninLogs
  | where TimeGenerated > ago(lookback)
  | where AppDisplayName has_any (dynamic(["RDP", "VPN", "Check Point", "ScreenConnect"])) or ResourceDisplayName has_any (dynamic(["VPN", "RD Gateway"]))
  | where ResultType !in ("0", "50125", "50140") or IPAddress !in (dynamic([]))
  | project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResourceDisplayName, ResultType, ResultDescription, RiskDetail
)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Artifacts=make_set(strcat(tostring(FileName), " | ", tostring(InitiatingProcessFileName), " | ", tostring(RemoteUrl)), 25) by DeviceName, AccountName, tableName
| where Hits >= 2
| order by LastSeen desc;

# Rapid MEDUSALOCKER readiness check: run as admin on servers and jump hosts.
$days = 7
$out = Join-Path $env:TEMP ("medusalocker_readiness_" + (Get-Date -Format yyyyMMdd_HHmmss) + ".txt")
"=== MedusaLocker Rapid Readiness $(Get-Date) ===" | Out-File $out

"--- RDP exposure ---" | Out-File $out -Append
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -eq 3389} | Format-Table LocalAddress,LocalPort,OwningProcess -Auto | Out-String | Out-File $out -Append

"--- New scheduled tasks last $days days ---" | Out-File $out -Append
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-$days)} | Select-Object TaskName,TaskPath,Date,Author,State | Format-Table -Auto | Out-String | Out-File $out -Append

"--- Recent local users and admins ---" | Out-File $out -Append
Get-LocalUser | Where-Object {$_.PasswordLastSet -gt (Get-Date).AddDays(-$days) -or $_.LastLogon -gt (Get-Date).AddDays(-$days)} | Format-Table Name,Enabled,LastLogon,PasswordLastSet -Auto | Out-String | Out-File $out -Append
Get-LocalGroupMember -Group Administrators -ErrorAction SilentlyContinue | Format-Table Name,ObjectClass,PrincipalSource -Auto | Out-String | Out-File $out -Append

"--- Volume Shadow Copy status ---" | Out-File $out -Append
(vssadmin list shadows 2>&1) | Out-File $out -Append
Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID,InstallDate,VolumeName | Format-Table -Auto | Out-String | Out-File $out -Append

"--- Suspicious processes/tool paths ---" | Out-File $out -Append
Get-CimInstance Win32_Process | Where-Object {$_.Name -match 'psexec|paexec|rclone|7z|winrar|screenconnect|anydesk|teamviewer' -or $_.CommandLine -match 'delete shadows|bootstatuspolicy|recoveryenabled|Compress-Archive|ADMIN\$|/node:'} | Select-Object ProcessId,Name,CommandLine,CreationDate | Format-List | Out-String | Out-File $out -Append

"--- Edge services to verify manually ---" | Out-File $out -Append
"Check Point gateways, Exchange, ScreenConnect servers, VPN concentrators and developer workstations with Nx Console must be patched/isolated per CISA KEV." | Out-File $out -Append
Write-Host "Wrote $out"