medusalocker Ransomware
Tracked since Nov 15, 2022
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Privilege Escalation
T1134.004 Parent PID Spoofing Observed tools
Credential Theft
Invoke-TheHash · Mimikatz
Defense Evasion
HRSword · PCHunter · ProcessHacker
Discovery Enum
Advanced IP Scanner · Advanced Port Scanner · SoftPerfect NetScan
LOLBAS
PsExec
Offsec
Impacket
RMM-Tools
Remote Desktop Plus (RDP+)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live