MedusaLocker Ransomware Recovery: What's Recoverable

MedusaLocker is a ransomware-as-a-service family first seen in 2019. Despite the similar name it is a different operation from Medusa ransomware. It is still active: in September 2026 it posted 13 victims on its leak site, two of them in India, alongside victims in Spain, the United States, Bangladesh and Canada (ransomware.live data).

MedusaLocker affiliates mostly enter through Remote Desktop (RDP) exposed to the internet with weak or stolen passwords, through VPN accounts without multi-factor authentication, and through phishing. Tools reported in its intrusions include Mimikatz and Invoke-TheHash for credentials, Advanced IP Scanner and SoftPerfect NetScan to map the network, PsExec to spread, and tools such as PCHunter and Process Hacker to stop security software.

Files are encrypted with AES, with the key protected by RSA, and get an extension that changes between versions and affiliates. The extension alone is therefore not a reliable way to identify the family: the ransom note and the encrypted files themselves are. Check the No More Ransom project for a decryptor for your exact version before anything else, and never run one on your only copy.

Recovery without the key comes from what was not encrypted: older backups and shadow copies that survived, and the unencrypted parts of large files such as databases and virtual disks. That is measured on the files before anything else is decided.

Isolate the affected systems, but do not wipe, reinstall or "clean" anything yet, and do not run decryptors found online on your only copy. Keep the ransom note, a few encrypted files and, if you have them, unencrypted copies of the same files from before the attack: comparing the two shows exactly how the files were encrypted.

Then establish what is recoverable before deciding anything else: how much of each database, virtual disk and backup file was encrypted, and what the untouched parts still hold. Large files are often only partly encrypted, and that is where recovery without the key comes from.