medusalocker

medusalocker is a ransomware group operating under an extortion-focused model, with tradecraft that includes phishing campaigns prompting victims to visit malicious pages and install remote-access tooling, as evidenced by the 2026-08-05 incident impersonating Bank of America that delivered ScreenConnect malware. ThreatCluster records 34 victims claimed by medusalocker, with the sectors hit most often Manufacturing, Technology, Business Services, Healthcare, and Energy, and the countries hit most often the United States, Germany, Canada, France, and Australia. A pattern across the reporting shows cross-sector and cross-geography reach, illustrated by the August 2026 phishing incident that demonstrates phishing-driven initial access and deployment of remote-access tooling.

Sectors: Manufacturing, Technology, Business Services · Countries: US, DE, CA