medusalocker
Activity analysis
HackerFeeds has tracked 123 victims claimed by medusalocker since November 2021, most recently in November 2026 — ranking #63 of 332 groups (0.4% of all tracked ransomware victims). It posted 45 victims in the last 90 days, up 309% on the previous 90 days (11). Its most-targeted sector is Manufacturing (18 victims), followed by Technology (16). The United States accounts for 13 victims (18% of those with a known location); 52 victims did not disclose a location.
Victims per year
- 20211
- 202221
- 202317
- 20245
- 20258
- 202671
Top sectors
- Manufacturing18
- Technology16
- Business Services13
- Other5
- Education5
- Agriculture and Food Production5
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
MITRE ATT&CK TTPs
Privilege Escalation
T1134.004Parent PID Spoofing
Recent victims
No victims tracked yet.