Threat Group Profile
medusalocker
● Active — last 30 days
Victim claims
26
First seen
May 2026
Last activity
07 Jul 2026
Tracked since
—
Group overview
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
Preferred targets
Business Services · 5
Consumer Services · 3
Manufacturing · 3
Public Sector · 3
Education · 3
Telecommunication · 1
Most targeted countries
BR · 3
DE · 3
GB · 3
US · 3
CA · 2
FR · 2
Tactics & techniques (MITRE ATT&CK)
Privilege Escalation
Parent PID Spoofing
