ShellCodeX
Tools • Events • News • Insights
 SEO Checker
Threat Group Profile

medusalocker

● Active — last 30 days
Victim claims 31
First seen May 2026
Last activity 16 Aug 2026
Tracked since Nov 2022

Group overview

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

Preferred targets

Business Services · 5 Manufacturing · 4 Consumer Services · 3 Public Sector · 3 Education · 3 Technology · 2

Most targeted countries

DE · 4 GB · 4 BR · 3 FR · 3 US · 3 CA · 2

Tactics & techniques (MITRE ATT&CK)

Privilege Escalation

Parent PID Spoofing

Victim Claims Timeline

Back to radar
Unknown

Twal Family IT Lab

Personal IT home lab. AD domain: twalfamily.com. VMware vSphere, multiple AD domains. Daniel Al Twal works at Technology North Corp (Edmonton), former DND co-op. No corpo...

Technology
🇬🇧 United Kingdom

All Parts Dry Cleaning

allpartsdrycleaning.co.uk

Dry cleaning & laundry. Domain: allpartsdrycleaning.co.uk. | United Kingdom

Retail & E-Commerce
🇩🇪 Germany

Idex Group

idex-group.com

Organization with 30 emails extracted. Domain: idex-group.com

Technology
🇫🇷 France

Bija Industrie

bija-industrie.com

Organization with 693 emails extracted. Domain: bija-industrie.com

Manufacturing
🇿🇦 South Africa

Thecourierguy

thecourierguy.co.za

Organization with 2018 emails extracted. Domain: thecourierguy.co.za

Transportation
🇨🇦 Canada

Forces

forces.gc.ca

Organization with 28 emails extracted. Domain: ***.gc.ca

🇧🇷 Brazil

Estrela

estrela.ind

Organization with 11 emails extracted. Domain: estrela.ind

Consumer Services
Unknown

Karneslegal

karneslegal.com

Organization with 23 emails extracted. Domain: karneslegal.com

Business Services
🇩🇪 Germany

Sgs Gmbh

sgs-gmbh.com

Organization with 933 emails extracted. Domain: sgs-gmbh.com

Business Services
Unknown

Dadolighting

dadolighting.com

Organization with 17 emails extracted. Domain: dadolighting.com

Manufacturing
🇩🇪 Germany

T Online

t-online.de

Organization with 823 emails extracted. Domain: t-online.de

Telecommunication
🇩🇪 Germany

FunkeScheid

FunkeScheid.com

Notarkanzlei FunkeScheid, Kanzlei im Ostend, Frankfurt. 9755 emails. AD: Kanzlei.FunkeScheid.com

Manufacturing
🇫🇷 France

Mairie Thiverval Grignon

mairie-thiverval-grignon.fr

Organization with 162 emails extracted. Domain: mairie-thiverval-grignon.fr

Public Sector
🇦🇪 United Arab Emirates

Dolrad

dolrad.ae

Organization with 69 emails extracted. Domain: dolrad.ae

🇨🇭 Switzerland

Bd

bd.zh.ch

Organization with 772 emails extracted. Domain: bd.zh.ch

Healthcare
🇲🇾 Malaysia

Elken Sdn Bhd

elken.com

MLM / health & beauty products company. ~16k emails extracted.

Consumer Services
🇧🇷 Brazil

Bandeirante Supermercados

bandeirantesupermercados.com.br

Brazilian supermarket chain.

Consumer Services
🇦🇺 Australia

Strategic Imports

Australian auto parts/batteries importer. Brands: Strategic Imports, Auto Parts Now, Discount Batteries Now. User: bstuart (Brad Stuart). QNAP NAS (CACHEDEV1_DATA).

Business Services
🇮🇱 Israel

Magnolia (Israel)

magnolia-jewellery.com

Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sells via buyme.co.il gift cards. ~38k files, invoices in Hebrew (SI/IN/O...

🇺🇸 United States

Atencio Engineering

atencioengineering.com

Civil engineering & land surveying firm. Services: site plans, boundary surveys, OWTS (septic) design, fire line design, elevation certificates, flood plain analysis. Cli...

Construction
🇮🇹 Italy

SIT Group / Robusta

sitgroup.it

Italian company SIT Group (sitgroup.it) and Bulgarian Robusta (robusta.bg). Also abv.bg emails.

Business Services
🇺🇸 United States

Desert Christian Schools (DCS)

K-12 Christian school affiliated with First Baptist Church of Lancaster, CA. ADP payroll, DCFS childcare program, City of Lancaster Water Safety program. Financial docs:...

Education
🇺🇸 United States

CourtSmart

courtsmart.com

Court technology company. Domain courtsmart.com / COURTSMART2. Dev server: dev-rich20.courtsmart.com. Connections to JIS.org, nashville.org.

Business Services
Unknown

Hathcock (Personal)

Personal comprehensive reports. Individuals: Noel Ray Hathcock, Trinity John Hathcock.

🇬🇧 United Kingdom

ActionAid / TACOSA

actionaid.org

NGO sector. Domains: actionaid.org, tacosa.org.za, immigration.go.tz.

Public Sector
🇬🇧 United Kingdom

Palmers Relocations

Australian international removals & relocation company. FIDI accredited, ISO 9001:2015 certified. Services: household moves, storage, customs, immigration (IMMI/VEVO). Op...

Transportation/Logistics
🇫🇷 France

Académie de Montpellier / CSJM

ac-montpellier.fr

French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credential...

Education
🇨🇷 Costa Rica

Colegio María Inmaculada (CMI)

mariainmaculada.ed.cr

Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2.

Education
🇧🇷 Brazil

CEAGESP / Netfeirasp

netfeirasp.ceagesp

Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts.

Agriculture and Food Production

Other Active Groups

View all activity
Dark Project 13 victim claims Last activity 9 hours ago qilin 533 victim claims Last activity 19 hours ago akira 142 victim claims Last activity 19 hours ago Deadlock 100 victim claims Last activity 22 hours ago