MedusaLocker Ransomware Recovery Services

Rely on Intelecis to prioritize your data recovery because downtime has a significant negative impact on business performance across all industries. Numerous businesses have benefited from the expertise of our well-equipped Ransomware Team.

What is MedusaLocker?

MedusaLocker is malicious software, which is classified as ransomware. It operates by encrypting files and keeping them inaccessible until a ransom is paid and the decryption software/tool is purchased. During the encryption process, all files are renamed with the “.encrypted” extension.

How Does MedusaLocker Ransomware Work?

The ransomware-as-a-service (RaaS) business model is also used by MedusaLocker. In exchange for a cut of the ransom money, the MedusaLocker’s creator distributes the ransomware to other threat actors.

RDP services that are vulnerable are frequently used by threat actors who utilize the MedusaLocker ransomware to obtain initial access to their victims’ networks. Once it has gained access, the ransomware restricts victims from accessing their data by following the standard ransomware assault lifecycle.

Ransom Note

MeduzaLocker’s ransom message claims that data has been exfiltrated, but as of right now, we have not seen any evidence of that from the malware:

What happens when a MedusaLocker attack is initiated?

MedusaLocker restarts the machine in safe mode before execution to increase the likelihood that the files on the infected machine will be encrypted successfully. By using this technique, security tools that might not launch in safe mode are avoided.

In order to avoid making the targeted system useless for paying the ransom, MedusaLocker doesn’t encrypt executable files. By combining AES and RSA-2048, MedusaLocker ups the danger factor even further and makes brute-forcing the encryption nearly hard.