MedusaLocker ransomware

MedusaLocker is Windows ransomware seen since 2019 and rented to affiliates, who keep roughly 55 to 60 percent of each payment. It is not the Medusa RaaS that surfaced in 2023, and Ako (MedusaReborn) has its own page. The appended extension changes with almost every build: affiliates pick a short word and tack a number on, so stems such as .marlock or .lockdata turn up with many different numeric endings, next to one-off words like .ReadInstructions. An HTML note, often HOW_TO_RECOVER_DATA.html or How_to_back_files.html, lands in every folder holding encrypted files and gives a personal ID plus one or more contact mailboxes; it usually offers to unlock one small file as proof. Most intrusions start at exposed RDP, with phishing attachments as the other common route. A batch file starts a PowerShell loader that flips the EnableLinkedConnections registry value so mapped drives become visible, then the malware probes the subnet and SMB shares to spread. It kills security and accounting processes, may reboot the host into Safe Mode, encrypts with AES-256 wrapped by an RSA-2048 key, and wipes shadow copies and local backups. Persistence is a copy named svhost.exe or svhostt.exe under %APPDATA%\Roaming plus a scheduled task firing every 15 minutes, so delete that task before restoring data or the restored files get locked again. Demands are sized to what the affiliate thinks the victim can pay.

Sources: FBI/CISA/Treasury/FinCEN AA22-181A, WatchGuard

File extensions: .Skynet, .marlock011, .marlock03, .marlock04, .marlock10, .marlock20, .marlock22, .marlock95, .read, .1btc, .247_davidhasselhoff (number in the extension may differ based on the ransomware's variant), .AKO, .alienlock, .allock8 (the number may differ depending on the sample), .alock, .attack[number] (e.g., .attack7, etc. depending on the variant), .attackfiles, .attacknew1, .attacksystem, .attackuk, .BB, .bulock16, .bulock16 (digit may vary depending on the ransomware variant), .bulwark7 (number can vary depending on the ransomware's variant), .busavelock53 (the number in the extension can vary), .cipher, .cipher1, .cipher2, .cipher3, .cipher4, .cipher5, .cipher8, .cipher9, .CRYPT, .CRYPTBD, .crypto1317 (the numbers in the extension can vary), .czlock, .datalock, .deadfiles, .deadnet26, .deathfiles, .destry30 (number may differ depending on ransomware variant), .divsouth, .EMPg296LCK, .eslock, .ever101, .exlock, .exlock20, .farlock11, .farlock3, .FartingGiraffeAttacks, .filesencrypted, .fileslock, .foxtrot70, .frlock, .gelts, .gonzofortuna, .grlock, .hazard, .hknet, .ik21, .infected, .itlock, .itlock20 (the number in the extension can vary), .krlock, .L16, .L30, .L47, .L54, .lock2020, .lock3, .locked9, .lockfile, .LockFiles, .lockfilesKR, .locklock, .locknet, .lockussss, .lr, .marlock7, .marnet2 (the number in the extension may vary), .medusalocker, .meduza24 (the number in the extension can vary), .mlock5, .nett, .networkmaze, .newlocker, .newnet, .ntlock2, .nz, .olsavelock31 (number can vary depending on the ransomware variant), .onelock, .pomoch45, .pomochit01, .protect3 (number can vary based on ransomware variant), .readinstruction, .ReadInstructions, .readlockfiles, .Readnet7 (the number in the extension can vary), .reads, .readtext4 (number may vary based on ransomware variant), .recovery, .recoverygr, .repair, .root4 (the number in the extension can vary), .RS, .run10 (the number in the extension can vary), .savelock52, .skylock, .skynetlock, .solution247, .spider1 (number may vary based on the ransomware variant), .stopfiles, .virus3 (number may vary based on ransomware variant), .youfileslock, .zalock, .zombi2 (number may vary based on variant), bulwark, bulwark1, bulwark2, bulwark3, bulwark4, bulwark5, bulwark7, bulwark8, bulwark9, e.g., etc., Extension depends on the Farlock variant, keversen, LATCHNETWORK3, lockhyp, marlock01, marlock25, mlock, mlock4, mlock7, netlock, ntlock18, ntlock21, pp, ReadSRead, SunnyDay, support, VinDizelPux

Ransom note filenames: how_to_back_files.html, HOW_TO_RECOVER_DATA.html, Recovery_Instructions.html, !-Recovery_Instructions-!.html, !!!HOW_TO_DECRYPT!!!.mht, How_to_back_files.txt, how_to_back.html, How_To_Recovery.txt, Instructions for decryption.txt, INSTRUCTIONS.html, readinstruction.html

Contact addresses: ithelp02[@]decorous[.]cyou, ithelp01[@]wholeness[.]business, ithelp02[@]wholeness[.]business, dec_helper[@]excic[.]com, ithelp01[@]decorous[.]cyou, ithelp09[@]decorous[.]cyou, ithelp09[@]wholeness[.]business, dec_helper[@]dremno[.]com, ithelp01[@]securitymy[.]name, ithelp01[@]yousheltered[.]com, diniaminius[@]winrof[.]com, helper[@]atacdi[.]com, ithelp02[@]securitymy[.]name, ithelp02[@]yousheltered[.]com, Mikesupp77[@]outlook[.]com, soterissylla[@]wyseil[.]com, pomocit01[@]kanzensei[.]top, pomocit01[@]surakshaguardian[.]com, restoreassistance[@]decorous[.]cyou, restoreassistance[@]wholeness[.]business, ithelp[@]decorous[.]cyou, ithelp[@]wholeness[.]business, ithelp07[@]securitymy[.]name, ithelp07[@]yousheltered[.]com, ithelp08[@]decorous[.]cyou, ithelp08[@]wholeness[.]business, ithelp1[@]decorous[.]cyou, coleman[.]dec[@]tutanota[.]com, help_24_decr1[@]outlook[.]com, ithelp03[@]decorous[.]cyou, ithelp03[@]wholeness[.]business, ithelp11[@]securitymy[.]name, ithelp11[@]yousheltered[.]com, ithelpnetwork[@]decorous[.]cyou, ithelpnetwork[@]wholeness[.]business, lauracc[@]msgsafe[.]io, solution247days[@]outlook[.]com, uncrypt-official[@]outlook[.]com, uncryptofficial[@]yahoo[.]com, wehavesolution[@]onionmail[.]org, adam.samosa1965[@]bk[.]ru, ambrelladuck[@]protonmail[.]com, assist1122[@]protonmail[.]com, assist112233[@]cock[.]li, berstife[@]gmail[.]com, best[@]desharonline[.]top, bitcoin[@]mobtouches[.]com, bitcoin[@]sitesoutheat[.]com, cmd[@]jitjat[.]org, crypt_group[@]outlook[.]com, crypt2024_tm123[@]outlook[.]com, dec_helper[@]outlook[.]com, dec_restore[@]protonmail[.]com, decoder23345667345[@]outlook[.]com, decrestore[@]cock[.]li, denis[.]gregory[@]mail[.]ru, dirhelp[@]keemail[.]me, doctorhelperss[@]gmail[.]com, emergency911service[@]outlook[.]com, emergencychina[@]tutanota[.]com, fuc_ktheworld1448[@]outlook[.]com, fucktheworld1448[@]cock[.]li, H3lp4You[@]onionmail[.]org, help_24_decr2[@]outlook[.]com, helpersdoctor[@]outlook[.]com, internationalassistance[@]tutanota[.]com, ithelp04[@]decorous[.]cyou, ithelp04[@]wholeness[.]business, ithelp08[@]securitymy[.]name, ithelp08[@]wholeness[.]busines, ithelp08[@]yousheltered[.]com, ithelp10[@]securitymy[.]name, ithelp10[@]yousheltered[.]com, ithelp15[@]securitymy[.]name, ithelp15[@]yousheltered[.]com, microhdd[@]firemail[.]cc, microhdd[@]tuta[.]io, misterthundersecur[@]protonmail[.]com, mrromber[@]cock[.]li, mrromber[@]tutanota[.]com, qhrghghk[@]protonmail[.]com, qhrghghk[@]tutanota[.]com, rapid[@]aaathats3as[.]com, reasonablehelp[@]outlook[.]com, restoreassistance_net[@]decorous[.]cyou, restoreassistance_net[@]wholeness[.]business, rpd[@]keemail[.]me, suntorydots[@]outlook[.]com, suntorydots[@]tutanota[.]com, support[@]securycasts[.]com, support1[@]cocerid[.]com, support2[@]adigad[.]com, support22[@]wefego[.]com, uncrypt2022[@]outlook[.]com, uncrypthelp[@]yahoo[.]com, Upgrade4you[@]onionmail[.]org

Tox handles: 3C9D49B928FDC3C15F0314217623A71B865909B308576B4B0D10AEA62C98677B4A3F160D5C93

Decryptor: We checked the public decryptor listings on 2026-10-29 and could not confirm whether one exists.

Data exfiltration risk: High — Exfiltrates files using cloud-storage utilities before AES-256 encryption of local drives and SMB shares.

Systems typically targeted: Healthcare and SME networks via vulnerable RDP and email phishing.

Do this first: Disable public-facing RDP endpoints, audit networks for unauthorized Remote Monitoring and Management (RMM) software, and isolate affected hosts.

From the ransom note !=READMY=!.txt:

! YOUR NETWORK HAS BEEN COMPROMISED! All your important files have been encrypted! Your files are safe! Only modified. ANY ATTEMPT TO RESTORE A FILE WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. No software available on internet can help you. We are the only ones able to solve your problem. […]