MedusaLocker ransomware Bitcoin addresses

MedusaLocker has been active since 2019. A 2022 joint advisory from CISA, the FBI and the US Treasury said it mostly gets in through poorly secured Remote Desktop (RDP) access.

If a ransom note asked you to pay one of these addresses, report the attack to the police before paying anyone. Paying a sanctioned group can be illegal. Check any address.

All

All ransomware families · What the ransomware data shows