Content available in original language
class="post-article">
Ransomware C++ Active since 2021

MedusaRansomware

Medusa ransomware BCrypt AES+RSA hibrit sifreleme kullanan cift gaspc. Dosyalari BCryptEncrypt ile sifreler, RSA kamu anahtari ile AES anahtarini korur. Veeam (VEEAMSQL2008R2), Windows Backup Engine (wbengine) ve Zoolz bulut yedekleme servislerini durdurur. Veri sizintisi tehdidi ile cift gasp (double extortion) yapar.

Also Known As: MedusaLocker
Threat Profile
Type Ransomware
Programming LanguageC++
C2 Protocol—
First Seen2021
Targets Windows
Purpose / Capabilities
  • Kritik altyapı ransomware
No C2 servers have been identified for this family yet.

Research Reports (1)

Kritik

MedusaRansomware 2e62a782 -- CMedusaCrypt BCryptEncrypt RSA DoubleExtortion VeeamKill WBEngine Zoolz PDB-GazeRelease TOR-Decrypt | Kritik

MedusaRansomware 2e62a782 PE32 310KB. .?AVCMedusaCrypt@@ BCryptEncrypt+RSA. Double extortion. Veeam/WBEngine/Zoolz kill. PDB: G:\Medusa\Release\gaze.pdb.

Read Report →