Threat actor believed to be spreading new Medusa Locker variant since 2022
Summary: Cisco Talos documented an attack deploying a MedusaLocker variant the attackers call "BabyLockerKZ," using publicly known tools plus custom wrappers named Checker, PTH and MIMIK that share the PDB path string "paid_memes." Talos assesses with medium confidence the actor is financially motivated, likely an initial access broker or ransomware affiliate, active since at least October 2022, with victims shifting from European countries to Latin America in the second quarter of 2023 as monthly attack volume nearly doubled to around 200 unique IPs compromised per month.
What you should know: Talos reports the actor has consistently compromised more than 100 organizations per month since at least 2022, and its custom tooling automates credential theft and lateral movement across PSEXEC, RDP, SMB and WMI - the same protocols most enterprises leave open internally.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026