Ransomware Group intelligence

Medusalocker

Active

Track Medusalocker with 104 published victims and 5 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 104 Known published victims in this dataset

First discovered 2022-11-15 Earliest victim discovery date

Last discovered 2026-10-05 Latest victim discovery date

Inactive since 11 days Days since the latest known victim

Top country United States 14 victims

Known locations 5 Leak or negotiation infrastructure tracked

Medusalocker is tracked by Breach House as a ransomware group with 104 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

104

Leaked 15 14.4%
Pending 89 85.6%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 5	Onion service	Up checked 5h ago	`t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion`
Leak location 4	Onion service	Down checked 5h ago	`medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion`
Leak location 3	Web location	Down checked 5h ago	`95.143.191.148:3000`
Leak location 2	Onion service	Down checked 5h ago	`z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion`
Leak location 1	Onion service	Down checked 5h ago	`qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion`

Communication / Marketing 19
Not identified 15
IT 10
Manufacturing / Engineering 10
Finance / Legal / Insurance 9
Services 8
Public Sector 7
Agriculture / Food 4
Retail / E-commerce 4
Education 4
Construction / Real Estate 3
Telecommunications 1
NGOs / Associations 1
Energy 1
Healthcare / Pharma 1
Hospitality / Food & Beverage / Tourism 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Medusalocker, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: medusalocker uses PowerShell scripts to execute ransomware payloads and propagate across compromised systems.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1112 Modify Registry PersistenceDefense Impairment

What they do: medusalocker modifies Windows Registry Run keys to ensure ransomware execution upon system startup.

What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: medusalocker uses registry run keys and startup folders to maintain persistence after reboots.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: medusalocker disables antivirus tools and security processes to prevent detection and hinder system recovery.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: medusalocker deletes Volume Shadow Copies and backup directories via system commands to eliminate recovery options.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1003.001 LSASS Memory Credential Access

What they do: medusalocker accesses and dumps LSASS memory to steal credentials for lateral movement and evasion.

What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
T1135 Network Share Discovery Discovery

What they do: medusalocker discovers network shares using SMB enumeration to identify additional victims for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: medusalocker moves laterally via SMB/Windows Admin Shares to encrypt additional machines within the network.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: medusalocker encrypts victim files and backups using its ransomware payload to maximize impact and extortion.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: medusalocker calls system recovery inhibitors to block backup restoration and force reliance on decryption.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Tools Observed (2)

▼

Software Medusalocker has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery & enumeration

Advanced IP Scanner SoftPerfect NetScan

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (21)

▼

$5,529,792 Received (USD)

795 Payments

21 Known wallets

$280,487 Largest single payment

2019-01-16 → 2022-10-13 Payment window

bitcoin · 21

Address	Chain	Received (USD)	Payments
`1AbRxRfP6yHePpi7jmDZkS4Mfpm1ZiatH5`	bitcoin	$1,194,661	388
`1PopeZ4LNLanisswLndAJB1QntTF8hpLsD`	bitcoin	$866,858	17
`1AereQUh8yjNPs9Wzeg1Le47dsqC8NNaNM`	bitcoin	$731,990	75
`1HEDP3c3zPwiqUaYuWZ8gBFdAQQSa6sMGw`	bitcoin	$658,778	94
`1PormUgPR72yv2FRKSVY27U4ekWMKobWjg`	bitcoin	$450,421	59
`1BkmiGWPLum8MzusqZsq6Tn7v4oUjqPLjC`	bitcoin	$241,977	35
`18wRbb94CjyTGkUp32ZM7krCYCB9MXUq42`	bitcoin	$200,665	57
`bc1qy7ewkfpfr4x4rp39uwgsh2u698sl2uhfadqfyt`	bitcoin	$190,877	1
`184ZcAoxkvimvVZaj8jZFujC7EwR3BKWvf`	bitcoin	$158,499	2
`1HZHhdJ6VdwBLCFhdu7kDVZN9pb3BWeUED`	bitcoin	$157,077	14
`1Edcufenw1BB4ni9UadJpQh9LVx9JGtKpP`	bitcoin	$139,328	14
`1DyMbw6R9PbJqfUSDcK5729xQ57yJrE8BC`	bitcoin	$129,235	16

+9 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

HOW_TO_RECOVER_DATA.html html · 3968 chars

<html>
    <style type="text/css">

      body {
      background-color: #f5f5f5;
      }

h1, h3{
  text-align:  center;
  text-transform: uppercase;
  font-weight: normal;
}


/*---*/
.tabs1{
    display: block;
    margin: auto;
}
.tabs1 .head{
    text-align: center;
    float: top;
    padding: 0px;
    text-transform: uppercase;
    font-weight: normal;
    display: block;
    background: #81bef7;
    color: #DF0101;
    font-size: 30px;
}

.tabs1 .identi {
    font-size: 10px;
    text-align:  center;
    float: top;
    padding: 15px;
    display: block;
    background: #81bef7;
    color: #DFDFDF;
}


.tabs .content {
  background: #f5f5f5;
  /*text-align: center;*/
  color: #000000;
  padding: 25px 15px;
  font-size: 15px;
  font-weight: 400;
  line-height: 20px; }
 .tabs .content a {
    color: #df0130;
    font-size: 23px;
    font-style: italic;
    text-decoration: none;
    line-height: 35px; }


.tabs .content .text{
padding: 25px;
line-height: 1.2;
}


    </style>


  <body>

    <div class="tabs1">
     <div class="head" ><b>Your personal ID:</b></div>
      <div class="identi">
      <span style="width:1000px; color: #ffffff; font-size: 10px;">[snip]</span> <br>
<!-- !!! dont changing this !!! -->
      </div>
    </div>
  <!-- -->
    <div class="tabs">
<!--tab-->  
    <div class="tab">
        <div id="tab-content1" class="content">
         
          <div class="text">
          <!--text data -->

          <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>

          <b>All your important files have been encrypted!</b><br><br>
	  <hr>
             Your files are safe! Only modified. (RSA+AES)<br><br>

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>

No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>

We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>


We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>

You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
          <!--text data -->
          <hr>
          <b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
              1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
              2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
              3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
          </a>
                        4. Start a chat and follow the further instructions. <br>
          <hr>			
          <b>If you can not use the above link, use the email:</b><br>
          <a href="[email protected]  ">[email protected]   </a> <br>
          <a href="[email protected] ">[email protected]   </a> <br>
          
          
          <p>* To contact us, create a new free email account on the site:  <a href="https://protonmail.com">protonmail.com <br>

<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>


          </div>
        </div>
    </div>
 <!--tab-->    

            
          <!--text data -->
          </div> 
        </div>
<!--tab--> 
    </div>
    
  </div>
  
  </body>
</html>

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (104)

Search, filter and paginate the victim timeline for Medusalocker. Showing 1–100 of 104.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Millensys id33471 View details	2026-10-05	Brazil	IT		pending
Organization with 2 emails extracted. Domain: millensys.com ID 33471
Ransomware	Rueegseggerag id33472 View details	2026-10-05	Switzerland	Manufacturing / Engineering		pending
Organization with 1 emails extracted. Domain: rueegseggerag.ch ID 33472
Ransomware	PKSF — Palli Karma-Sahayak Foundation id33260 View details	2026-09-28	Bangladesh	Other		pending
Organization with 13 emails extracted. Domain: 08trl.exit ID 33260
Ransomware	Juntadeandalucia id33246 View details	2026-09-28	Spain	Public Sector		pending
Organization with 198 emails extracted. Domain: juntadeandalucia.es ID 33246
Ransomware	Premiumfruits id33247 View details	2026-09-28	Spain	Agriculture / Food		pending
Organization with 3292 emails extracted. Domain: premiumfruits.eu ID 33247
Ransomware	ATCO Ltd id33237 View details	2026-09-28	Canada	IT		pending
Organization with 80 emails extracted. Domain: mail.gmail.com ID 33237
Ransomware	Aokkef id33080 View details	2026-09-23	France	Services		pending
Organization with 137 emails extracted. Domain: aokkef.fr ID 33080
Ransomware	Seznam id33081 View details	2026-09-23	Czechia	Retail / E-commerce		pending
Organization with 115 emails extracted. Domain: seznam.cz ID 33081
Ransomware	Abv id33082 View details	2026-09-23	Bulgaria	Manufacturing / Engineering		pending
Organization with 583 emails extracted. Domain: abv.bg \| Sofia, Bulgaria ID 33082
Ransomware	瑞祥机电 (Ruixiang Jidian) id32768 View details	2026-09-12	China	Manufacturing / Engineering		pending
Elevator manufacturer, brand 银海 (Yinhai). Produces machine-room-less (MRL) passenger elevators and OEMs elevator components (car top/bottom, car wall panels, COP, doors) for OTIS, KONE, Hitachi, Toshiba, TKS (蒂升). Export business (project DUBROVSKIY-2, customer 赛博). Infrastructure: Synology NAS (admin), IT dept with Epson L1118. \| China, Jiangsu Province (黎民北路 / Limin North Road) ID 32768
Ransomware	Abourametals id32769 View details	2026-09-12	United Arab Emirates	Manufacturing / Engineering		pending
Organization with 25448 emails extracted. Domain: abourametals.com ID 32769
Ransomware	Frisby Roofing (Frisby Construction LLC) id32770 View details	2026-09-12	United States	Construction / Real Estate		pending
Residential roofing contractor (family-owned, locally operated). Complete roof tear-off and replacement, dimensional shingles (CertainTeed, Tamko Heritage, GAF), ice/water shield, flashing, ventilation, gutter aprons, pipe boot flashing. Phone: (513) 924-4377 (main/24-7), (513) 576-0679 (showroom/office); email [email protected]; web www.FrisbyRoofing.com. Suppliers: QXO (Cincinnati branch), Beacon Building Products (Tri-Built/CertainTeed), Mueller, NisbetBrower, The Patch Boys, Corken Steel, McCabe Lumber; subcontractor BullDogg Home Repairs (Kenny Goodin). Payroll: Paycor/PaySimple (staff incl. Nathan Wilson, Field Tech). Legal: mechanic's liens and lien releases (Hamilton/Clermont County Recorder), Chapter 13 case 1:26-bk-10008 (Pickelheimer). \| USA, Ohio: 1375 State Route 131, Suite D1, Milford, OH 45150 (physical showroom); service area: Cincinnati metro / Hamilton, Butler, Clermont, Warren counties; BBB accredited since 02/25/2009, rating A+, 4.98/5 (131 reviews), 10,000+ roofs completed ID 32770
Ransomware	Praveg Caves Jawai id32771 View details	2026-09-12	India	Manufacturing / Engineering		pending
Luxury safari resort near Jawai leopard reserve, Sumerpur (Pali), Rajasthan, India (phone +91 777 908 4007). Runs IDS Fortune V5 hotel PMS/POS (customer code 9473, runtime C:\Program Files\IDS\FortuneV5runtime); restaurant PANTHERA and Panthera Bar; safari tours; OTAs: MakeMyTrip, Goibibo, swiftbook.io, Journey Expeditions; staff: HARSH, VINODK, ATANU, ADITYA THAKUR. \| Near Jivda Gate, Bija Pur Road, Bijapur, Jawaband Road, Sumerpur (Pali), Rajasthan, 306126 ID 32771
Ransomware	Licindia id32413 View details	2026-09-02	India	Services		pending
Organization with 9 emails extracted. Domain: licindia.com ID 32413
Ransomware	Lawter id32375 View details	2026-09-01	United States	IT		pending
Organization with 150 emails extracted. Domain: lawter.com ID 32375
Ransomware	Jgsee id32180 View details	2026-08-27	Thailand	Education		pending
Organization with 4 emails extracted. Domain: jgsee.kmutt.ac.th ID 32180
Ransomware	Servifruit id32181 View details	2026-08-27	Mexico	Agriculture / Food		pending
Organization with 195 emails extracted. Domain: servifruit.com ID 32181
Ransomware	Hungry Lion id32182 View details	2026-08-27	Ghana	—		pending
Fast food franchise (burgers, chicken, chips, ice cream) - 111 locations across South Africa, Botswana, Namibia, Zambia, Zimbabwe, Lesotho, Mauritius. Three POS systems: Unity POS (242MB monthly), GAAP POS (daily), CoSoft POS (145 terminals). \| Botswana ID 32182
Ransomware	Qualisteel id32183 View details	2026-08-27	United States	IT		pending
Organization with 7568 emails extracted. Domain: qualisteel.com ID 32183
Ransomware	Health id32184 View details	2026-08-27	Australia	Public Sector		pending
Organization with 103 emails extracted. Domain: health.nsw.gov.au ID 32184
Ransomware	Twal Family IT Lab id31769 View details	2026-08-16		—		pending
Personal IT home lab. AD domain: twalfamily.com. VMware vSphere, multiple AD domains. Daniel Al Twal works at Technology North Corp (Edmonton), former DND co-op. No corporate target. Previously misidentified as Forces/forces.gc.ca. \| 4172 Wolfe Point Way, Ottawa, ON K1V 1P5, Canada ID 31769
Ransomware	All Parts Dry Cleaning id31770 View details	2026-08-16	United Kingdom	—		pending
Dry cleaning & laundry. Domain: allpartsdrycleaning.co.uk. \| United Kingdom ID 31770
Ransomware	Idex Group id31771 View details	2026-08-16	Germany	—		pending
Organization with 30 emails extracted. Domain: idex-group.com ID 31771
Ransomware	Bija Industrie id31772 View details	2026-08-16	France	—		pending
Organization with 693 emails extracted. Domain: bija-industrie.com ID 31772
Ransomware	Thecourierguy id31773 View details	2026-08-16	South Africa	—		pending
Organization with 2018 emails extracted. Domain: thecourierguy.co.za ID 31773
Ransomware	Forces id30308 View details	2026-07-07	Canada	Public Sector		pending
Organization with 28 emails extracted. Domain: ***.gc.ca ID 30308
Ransomware	Estrela id30168 View details	2026-07-01	Brazil	Agriculture / Food		leaked
Organization with 11 emails extracted. Domain: estrela.ind ID 30168
Ransomware	Karneslegal id30169 View details	2026-07-01	United States	Finance / Legal / Insurance		pending
Organization with 23 emails extracted. Domain: karneslegal.com ID 30169
Ransomware	Sgs Gmbh id30170 View details	2026-07-01	Germany	Manufacturing / Engineering		pending
Organization with 933 emails extracted. Domain: sgs-gmbh.com ID 30170
Ransomware	Dadolighting id30171 View details	2026-07-01	United States	Manufacturing / Engineering		pending
Organization with 17 emails extracted. Domain: dadolighting.com ID 30171
Ransomware	T Online id30172 View details	2026-07-01	Germany	Telecommunications		pending
Organization with 823 emails extracted. Domain: t-online.de ID 30172
Ransomware	FunkeScheid id30173 View details	2026-07-01	Germany	IT		pending
Notarkanzlei FunkeScheid, Kanzlei im Ostend, Frankfurt. 9755 emails. AD: Kanzlei.FunkeScheid.com ID 30173
Ransomware	Mairie Thiverval Grignon id30174 View details	2026-07-01	France	Public Sector		pending
Organization with 162 emails extracted. Domain: mairie-thiverval-grignon.fr ID 30174
Ransomware	Dolrad id30175 View details	2026-07-01	United Arab Emirates	Construction / Real Estate		pending
Organization with 69 emails extracted. Domain: dolrad.ae ID 30175
Ransomware	Bd id30176 View details	2026-07-01	Switzerland	Public Sector		pending
Organization with 772 emails extracted. Domain: bd.zh.ch ID 30176
Ransomware	Penticton and District Society for Community Living id30177 View details	2026-07-01	Canada	IT		leaked
Canadian charity providing disability-related services. CRA Registration: 119090686RR0001 \| Penticton, British Columbia, Canada ID 30177
Ransomware	Elken Sdn Bhd id29024 View details	2026-05-05	Malaysia	Retail / E-commerce		leaked
MLM / health & beauty products company. ~16k emails extracted. ID 29024
Ransomware	Bandeirante Supermercados id29025 View details	2026-05-05	Brazil	Retail / E-commerce		leaked
Brazilian supermarket chain. ID 29025
Ransomware	Strategic Imports id29026 View details	2026-05-05	Australia	Manufacturing / Engineering		leaked
Australian auto parts/batteries importer. Brands: Strategic Imports, Auto Parts Now, Discount Batteries Now. User: bstuart (Brad Stuart). QNAP NAS (CACHEDEV1_DATA). ID 29026
Ransomware	Magnolia (Israel) id29027 View details	2026-05-05	Israel	Manufacturing / Engineering		leaked
Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sells via buyme.co.il gift cards. ~38k files, invoices in Hebrew (SI/IN/OV prefix). ID 29027
Ransomware	Trimble Inc / Gerrard Inc id29028 View details	2026-05-05	United States	IT		leaked
Technology company Trimble (trimble.com) and Gerrard Inc (gerrardinc.com). ~18 Trimble email addresses. ID 29028
Ransomware	Atencio Engineering id29029 View details	2026-05-05	United States	Construction / Real Estate		leaked
Civil engineering & land surveying firm. Services: site plans, boundary surveys, OWTS (septic) design, fire line design, elevation certificates, flood plain analysis. Clients in Las Animas County, Pueblo County, Florence CO area. ID 29029
Ransomware	SIT Group / Robusta id29030 View details	2026-05-05	Italy	Other		leaked
Italian company SIT Group (sitgroup.it) and Bulgarian Robusta (robusta.bg). Also abv.bg emails. ID 29030
Ransomware	Desert Christian Schools (DCS) id29031 View details	2026-05-05	United States	Public Sector		leaked
K-12 Christian school affiliated with First Baptist Church of Lancaster, CA. ADP payroll, DCFS childcare program, City of Lancaster Water Safety program. Financial docs: P&L, Balance Sheet, Trial Balance, 1099s. School Board minutes 2025. ID 29031
Ransomware	CourtSmart id29032 View details	2026-05-05	United States	IT		leaked
Court technology company. Domain courtsmart.com / COURTSMART2. Dev server: dev-rich20.courtsmart.com. Connections to JIS.org, nashville.org. ID 29032
Ransomware	Hathcock (Personal) id29033 View details	2026-05-05		Other		leaked
Personal comprehensive reports. Individuals: Noel Ray Hathcock, Trinity John Hathcock. ID 29033
Ransomware	ActionAid / TACOSA id29034 View details	2026-05-05	United Kingdom	NGOs / Associations		pending
NGO sector. Domains: actionaid.org, tacosa.org.za, immigration.go.tz. ID 29034
Ransomware	Palmers Relocations id29035 View details	2026-05-05	United Kingdom	Services		leaked
Australian international removals & relocation company. FIDI accredited, ISO 9001:2015 certified. Services: household moves, storage, customs, immigration (IMMI/VEVO). Operates Melbourne area (Pascoe Vale, Dandenong, Caulfield). ID 29035
Ransomware	Académie de Montpellier / CSJM id29036 View details	2026-05-05	France	Education		leaked
French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credentials. ID 29036
Ransomware	Colegio María Inmaculada (CMI) id29037 View details	2026-05-05	Costa Rica	Education		leaked
Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2. ID 29037
Ransomware	CEAGESP / Netfeirasp id29038 View details	2026-05-05	Brazil	Retail / E-commerce		pending
Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts. ID 29038
Ransomware	Raycolighting id29039 View details	2026-05-05	United Kingdom	Other		pending
Organization with 2 emails extracted. Domain: raycolighting.com ID 29039
Ransomware	dulay.ca id23957 View details	2025-11-18	Canada	Communication / Marketing		pending
Price-$40000 (sale in one hand there are options for making a profit from these files will be included in the deal) 500Gb ID 23957
Ransomware	usenergy id22359 View details	2025-09-14	United States	Energy		pending
Price-$120000 (sale in one hand there are options for making a profit from these files will be included in the deal) ID 22359
Ransomware	Looking for pentesters id21590 View details	2025-08-06		Other		pending
Looking for pentesters is an Other-sector listing identified in threat-intelligence coverage as a MedusaLocker target. Public reporting describes MedusaLocker as a ransomware group that posted a recruitment-style notice on its leak site seeking pentesters with direct access to corporate networks, including environments such as ESXi, Windows, and ARM systems. The available reporting does not establish a formal corporate profile, offering set, or geographic location for this entity beyond the listing context. It was listed as a ransomware victim associated with medusalocker. ID 21590
Ransomware	UnigazJordan id20337 View details	2025-05-30	Jordan	Other		pending
www.unigaz.net $690.6 Million The list of files is available at the link https://dropmefiles.com/9HGAJ ID 20337
Ransomware	Mulia Raya id20305 View details	2025-05-29	Indonesia	Other		pending
www.muliaraya.co.id $34.8 Million The list of files is available at the link https://dropmefiles.com/lAZQo ID 20305
Ransomware	Curtain Bluff id18702 View details	2025-03-25	Antigua and Barbuda	Finance / Legal / Insurance		pending
www.curtainbluff.com Curtain Bluff files Vacationer information (personal data), audit information (including past years), bank activity (statements with all transactions), internal organization documentation (even the menu) and other documents.There are also large amounts of account data (about 500 unique login/password pairs). Price – $120,000 ID 18702
Ransomware	Inversiones Clinica Del Meta SA id18092 View details	2025-02-28	Colombia	Healthcare / Pharma		pending
www.clinicameta.co Description employee information – patient information – agreements – password data – appointment information Sold with 1-day access Price-$100000 (sale in one hand there are options for making a profit from these files will be included in the deal) ID 18092
Ransomware	MICRO MANUFACTRING id17454 View details	2025-02-12	United States	Communication / Marketing		pending
Micro Manufacturing Inc. Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files. password data\\ Sold with 1-day access Price-$120000 (sale in one hand there are options for making a profit from these files will be included in the deal ID 17454
Ransomware	bendixengineering id16545 View details	2025-01-09	United States	Manufacturing / Engineering		pending
Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Data-2016-2024 years Price-$50000 (sale in one hand there are options for making a profit from these files will be included in the deal ID 16545
Ransomware	SILKNET COMPANY id15662 View details	2024-11-26	United States	Finance / Legal / Insurance		pending
URL:https://silknet.com https://geocell.ge/ On sale:Company email base(about 1tb)Customer dataCompany audit for 2023\24and more than 3tb of data. Price-$800000 There are a lot of corporate data, passports and other information. ID 15662
Ransomware	Protected: HIDE NAME id12401 View details	2024-05-09		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 12401
Ransomware	SHAMASS.ORG id12239 View details	2024-05-02	United States	Communication / Marketing		pending
Descriptionemployee information – agreement – customer email(.xls)-.msg outlook files Price-$50000 (sale in one hand there are options for making a profit from these files will be included in the deal) ID 12239
Ransomware	Protected: HIDE NAME SELL DATA SOON id12147 View details	2024-04-26		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 12147
Ransomware	Protected: Name is hidden id9793 View details	2023-11-29		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 9793
Ransomware	skalar.com id9786 View details	2023-11-29		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 9786
Ransomware	Ada-Borup-West School id9182 View details	2023-10-23		Education		pending
Descriptionemployee information – student information – all contracts Price: 35000$ ID 9182
Ransomware	wellons.org id9181 View details	2023-10-23		Communication / Marketing		pending
Descriptionemployee information – agreement – customer email(.xls)- pst files 15+GB all outlook message 2006-2023 year Price: 55000$ ID 9181
Ransomware	Confidential files id8933 View details	2023-10-02		Finance / Legal / Insurance		pending
A large number of documents of large companies are available for sale Revenue-$10-$70kk Financial documents, client cases, passports, tax evasion and many other documents are in closed sale, please contact qtox to coordinate the sale ID 8933
Ransomware	INSULCANA CONTRACTING LTD id8032 View details	2023-08-03		Communication / Marketing		pending
Descriptionemployee information – agreement – customer email(.xls)- passport all canada and other documents Price: 35000$ ID 8032
Ransomware	Protected: INSULCANA CONTRACTING LTD id7950 View details	2023-07-27		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 7950
Ransomware	Protected: Hidden name id7335 View details	2023-07-17		Communication / Marketing		pending
There is no excerpt because this is a protected post. ID 7335
Ransomware	Hoosier Equipment company id7114 View details	2023-07-04		Communication / Marketing		pending
DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$ ID 7114
Ransomware	Ucamco Belgium id7100 View details	2023-07-02		Finance / Legal / Insurance		pending
DescriptionClient Case – customers email-Audit information-There is also access to email for newsletters on behalf of the company PRICE-$80000 ID 7100
Ransomware	reutlingen.ihk.de id7011 View details	2023-06-24	Germany	Communication / Marketing		pending
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000 ID 7011
Ransomware	Hausamman company id7010 View details	2023-06-24		Communication / Marketing		pending
DescriptionClient Case – customers email-documents PRICE-$20000 ID 7010
Ransomware	kafflogistic.hu id7009 View details	2023-06-24	Hungary	Communication / Marketing		pending
DescriptionClient Case – agreement – email(outlook files)- contracts – and other documents PRICE-$50000 ID 7009
Ransomware	SELL DATA(qtox) id7008 View details	2023-06-24		Communication / Marketing		pending
Available for sale: to buy please contact qtox price negotiable qtox-E9CD65687463F67F64937E961DD723DC82C79CB548375AAE8AA4A0698D356C5E7E157B22E8CD ID 7008
Ransomware	Jalux Americas, Inc. id6855 View details	2023-06-14		Communication / Marketing		pending
DescriptionClient Case – agreement – email(.msg) – and other documents Price: 160000$The company failed to take care of the data leak and therefore ,many contracts and other documents have been leaked to the Internet.We are also going to provide any documents related to the aforementioned company if any law enforcement agency should request it ID 6855
Ransomware	arborsct.com id6854 View details	2023-06-14		Finance / Legal / Insurance		pending
DescriptionClient Case – agreement – email(.msg)- and other documents Price: 60000$ One copy will be sold, confidential informationThe company did not take care of the data leak, and therefore we will sell many contracts, customer data, financial component and other documentsin one lot for $ 60,000 for verification in the darknet or bank ID 6854
Ransomware	Salmon Software id6720 View details	2023-06-03		IT		pending
DescriptionClient Case – agreement – email(.msg)- passport- and other documents Price: 120000$ Three copies will be sold, confidential informationThe company failed to take care of the data leak and therefore ,many contracts and other documents have been leaked to the Internet.Other: contracts, agreements and other bank checks, we will sell everything in one lot for… Continue reading Salmon Software ID 6720
Ransomware	LETAPE JEUNES id6719 View details	2023-06-03		Communication / Marketing		pending
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents(passports) PRICE-$40000 ID 6719
Ransomware	bsw-architects.com id6080 View details	2023-04-11		Communication / Marketing		pending
DescriptionClient Case – agreement – email(.msg)- contracts – and other documents PRICE-$80000 There are many projects, agreements and contracts that can be sold separately ID 6080
Ransomware	DGLEGAL id4602 View details	2022-11-15		Finance / Legal / Insurance	—	pending
No additional victim description available. ID 4602
Ransomware	emscrm id4601 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4601
Ransomware	MIDAS Company id4600 View details	2022-11-15		Services	—	pending
No additional victim description available. ID 4600
Ransomware	AURIS KONINKLIJKE AURIS GROEP id4599 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4599
Ransomware	fidelityunited.ae id4598 View details	2022-11-15	United Arab Emirates	Other	—	pending
No additional victim description available. ID 4598
Ransomware	goldcreekfoods id4597 View details	2022-11-15		Agriculture / Food	—	pending
No additional victim description available. ID 4597
Ransomware	exheat.com id4596 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4596
Ransomware	hwrpc.com id4595 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4595
Ransomware	tristatefabricators_inc id4593 View details	2022-11-15		Public Sector	—	pending
No additional victim description available. ID 4593
Ransomware	atlantisholidays id4592 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4592
Ransomware	archimages inc id4591 View details	2022-11-15		Services	—	pending
No additional victim description available. ID 4591
Ransomware	ALTlTUDE AEROSPACE INC id4590 View details	2022-11-15		Services	—	pending
No additional victim description available. ID 4590
Ransomware	Fonderia Boccacci id4589 View details	2022-11-15		Other	—	pending
No additional victim description available. ID 4589
Ransomware	Zelena Laguna Hotel id4588 View details	2022-11-15		Hospitality / Food & Beverage / Tourism	—	pending
No additional victim description available. ID 4588
Ransomware	LEGAZPIBANK id4587 View details	2022-11-15		Finance / Legal / Insurance	—	pending
No additional victim description available. ID 4587
Ransomware	MCCLEAN16 company id4586 View details	2022-11-15		Services	—	pending
No additional victim description available. ID 4586

Medusalocker

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (5)

Top Activity Sectors (16)