Threat Spotlight: Medusa Locker
Summary: Cisco Talos detailed MedusaLocker, a ransomware family observed since 2019 that copies itself to %APPDATA%\Roaming, creates a Windows scheduled task to run every 15 minutes, deletes shadow copies with vssadmin, and appends an extension such as ".encrypted" to files. The malware performs ICMP sweeping to find other hosts, uses SMB to enumerate and encrypt accessible network shares, and uses the Windows registry to force reconnection to shared network drives.
Why it matters: Talos notes that given MedusaLocker's network awareness, the damage a single infected system could do inside a corporate environment is high - and the malware's hardcoded mutex values give defenders a blocklisting option before that first host spreads encryption across your shares.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026