MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5692 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Mimikatz Execution, LSASS Access, SAM/Secrets Dumping and Pass-the-Hash (MedusaLocker / BabyLockerKZ Credential Theft)

Detects Mimikatz command-line modules and suspicious LSASS process access, the credential theft tooling Cisco Talos and ransomware.live attribute to MedusaLocker and the BabyLockerKZ variant (credential checker and MIMIK wrapper). Covers T1003.001 for MedusaLocker TL-2026-5692.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1003.002, T1550.002
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=10 TargetImage="*lsass.exe" GrantedAccess IN ("0x1010", "0x1410", "0x1438", "0x143a", "0x1fffff") NOT SourceImage IN ("*MsMpEng.exe", "*MsSense.exe", "*csrss.exe", "*wininit.exe", "*WerFault.exe", "*vmtoolsd.exe")) OR (EventCode=1 (CommandLine="*sekurlsa::*" OR CommandLine="*lsadump::*" OR CommandLine="*privilege::debug*" OR CommandLine="*kerberos::ptt*" OR Image="*mimikatz*" OR OriginalFileName="mimikatz.exe")))
| eval signal=case(EventCode=10,"lsass_access", like(lower(CommandLine),"%sekurlsa::pth%") OR like(lower(CommandLine),"%kerberos::ptt%"),"pass_the_hash_or_ticket", like(lower(CommandLine),"%lsadump::sam%") OR like(lower(CommandLine),"%lsadump::secrets%") OR like(lower(CommandLine),"%lsadump::dcsync%"),"credential_database_dump", true(),"mimikatz_command_line")
| stats count values(signal) as signals values(SourceImage) as source_images values(GrantedAccess) as access_masks values(CommandLine) as command_lines min(_time) as first_seen by host
| convert ctime(first_seen)

Microsoft KQL

union
(DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex "(?i)sekurlsa::|lsadump::|privilege::debug|kerberos::ptt" or FileName =~ "mimikatz.exe" or ProcessVersionInfoOriginalFileName =~ "mimikatz.exe"
    | extend Source = case(ProcessCommandLine matches regex "(?i)sekurlsa::pth|kerberos::ptt", "pass_the_hash_or_ticket", ProcessCommandLine matches regex "(?i)lsadump::(sam|secrets|dcsync)", "credential_database_dump", "process")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Source),
(DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "OpenProcessApiCall" and AdditionalFields has "lsass.exe"
    | where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MsSense.exe", "csrss.exe", "wininit.exe", "WerFault.exe", "vmtoolsd.exe")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, Source = "lsass_access")

Sigma

title: Mimikatz Command-Line Modules Used by MedusaLocker Affiliates
id: c3a7d915-4e08-4f6b-a1d2-9e5b8f3c7603
status: experimental
description: Detects Mimikatz module invocations (sekurlsa, lsadump, privilege::debug, kerberos::ptt) or a mimikatz.exe image, matching the credential theft tooling attributed to MedusaLocker and BabyLockerKZ.
references:
    - https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/
    - https://www.ransomware.live/group/medusalocker
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.002
    - attack.lateral-movement
    - attack.t1550.002
    - attack.s0002
    - attack.tool.mimikatz
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        CommandLine|contains:
            - 'sekurlsa::'
            - 'lsadump::'
            - 'privilege::debug'
            - 'kerberos::ptt'
    selection_image:
        Image|endswith: '\mimikatz.exe'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or penetration testing exercises
level: critical

Known false positives:

• Authorized red team or penetration test using Mimikatz
• Endpoint security or backup agents that open LSASS with the listed access masks and are not yet in the exclusion list

Tuning notes: Extend the SourceImage exclusion list with your EDR and monitoring agents (validate by full path and signer). Renamed Mimikatz binaries are still caught by the command-line modules and LSASS access signal. Requires Sysmon EventCode 10 for the LSASS access branch; scope Sysmon config to LSASS targets to keep volume low.

• 🔒 External RDP Logon After Repeated Failures from a Public IP (MedusaLocker Initial Access) · unlock with TL Creds
• 🔒 Security Software Tampering: HRSword, PCHunter, Process Hacker and Security/Business Service Stops · unlock with TL Creds
• 🔒 MedusaLocker Lateral Movement and Network Discovery: PsExec, Impacket wmiexec, NetScan and Advanced Port Scanner · unlock with TL Creds
• 🔒 Reflective PE Injection and Invoke-TheHash PowerShell Script Blocks · unlock with TL Creds
• 🔒 MedusaLocker Registry Tampering: EnableLinkedConnections and PAIDMEMES Keys · unlock with TL Creds
• 🔒 MedusaLocker Ransom Note [indicator] and Masqueraded svhost Binary File Creation · unlock with TL Creds
• 🔒 MedusaLocker [indicator] / [indicator] Roaming Persistence and 15-Minute Scheduled Task · unlock with TL Creds
• 🔒 MedusaLocker Recovery Inhibition: Shadow Copy Deletion, Startup Recovery Disable and Safe Mode Boot · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5692.

Sample indicators (3 of 29)

• IP address: 95.143.191[.]148
• Domain: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd[.]onion
• File hash: 012657c4548d9c98223caa4cc7aa52fc083d6983d42fde16ca3271412e7fe3fe

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Technical analysis

This record tracks a leak-site listing, not a confirmed incident. The ransomware.live tracker entry for 'Capetown' attributes the listing to the MedusaLocker group, with a discovery timestamp of 2026-11-10 22:57 UTC and an estimated attack date of 2026-11-10. The entry states no country or sector and lists no website, IOCs or ransom amount. Its description block is a generic text about a logistics company offering sea, air and road freight, warehousing and customs services, and it names that company as DSV. That does not match the victim name 'Capetown', so it is not possible to say which organization, if any, was actually compromised. Treat the identity, sector and geography as unverified, and do not assume that DSV was breached. The entry carries one leak screenshot, and other recent MedusaLocker entries on the tracker (Msn, Dian, baiapai, Vinitgloves, Jatl) are dated 2026-11-04.

Background on the group comes from ransomware.live's group profile and public reporting. MedusaLocker was the subject of the joint CISA/FBI/Treasury/FinCEN advisory AA22-181A (published 2022-06-30, revised 2022-08-11). The advisory says actors mainly gain initial access through vulnerable RDP configurations (T1133), and also through phishing and spam campaigns that sometimes attach the ransomware directly (T1566). A batch file runs a PowerShell script (invoke-ReflectivePEInjection) that spreads the malware across the network. The ransomware copies itself as svhost.exe or svhostt.exe to %APPDATA%\Roaming and creates a scheduled task that runs it every 15 minutes. It edits the EnableLinkedConnections registry value and restarts LanmanWorkstation to enable network-wide host and share discovery. It restarts the machine in safe mode, deletes local backups and shadow copies, and disables startup recovery options. It kills processes of security, accounting and forensic software, and encrypts files with AES-256, with the AES key protected by an RSA-2048 public key. Ransom notes such as HOW_TO_RECOVER_DATA.html are dropped, and the advisory assesses the model as ransomware-as-a-service with an affiliate/developer payment split of 55-60% to the affiliate.

Cisco Talos (2024-10-03) documented a related actor spreading a MedusaLocker variant called BabyLockerKZ. It uses the same chat and leak sites as MedusaLocker and carries PAIDMEMES registry keys. Its toolset includes a credential checker bundling RDP Plus, PsExec, Mimikatz and Invoke-TheHash, a MIMIK wrapper around Mimikatz and rclone, and public tools such as HRSword, Advanced Port Scanner, SoftPerfect Netscan, Process Hacker and PCHunter. The ransomware.live group profile lists the same tools, plus Impacket and Parent PID Spoofing. Talos assessed with medium confidence that this actor is financially motivated. The profile shows 122 listed victims across 28 countries as of 2026-11-10, with manufacturing, technology and professional services as the top sectors. Whether the Capetown listing involves BabyLockerKZ-style tooling is not stated by any source, and no technical detail is inferred for this specific victim. The group page's description block describes the unrelated 'Medusa' DDoS botnet and should not be used for MedusaLocker analysis. MedusaLocker is also unrelated to the Medusa ransomware covered in CISA advisory AA25-071A.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash

Discovery

T1046 Network Service Discovery; T1135 Network Share Discovery

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1688 Safe Mode Boot

Initial Access

T1133 External Remote Services; T1566 Phishing

Privilege Escalation

T1134.004 Access Token Manipulation: Parent PID Spoofing

Impact

T1490 Inhibit System Recovery

Remediation

Patches

• Patch known exploited vulnerabilities on internet-facing systems, as recommended in CISA AA22-181A

Immediate actions

• Do not treat the Capetown listing as a confirmed breach of any named organization; verify the victim identity through the affected organization or its incident response provider before acting
• Audit internet-exposed RDP and remove or place it behind a VPN with MFA
• Hunt for svhost.exe or svhostt.exe in %APPDATA%\Roaming and for scheduled tasks that run every 15 minutes
• Hunt for HOW_TO_RECOVER_DATA.html ransom notes and HKLM\SOFTWARE\PAIDMEMES registry keys
• Search for the SHA256 hashes and contact emails listed in this record

Workarounds

• Restrict RDP by network policy and limit SMB lateral access
• Monitor for safe-mode boot changes and for shadow copy or backup deletion

Longer-term hardening

• Maintain offline, immutable backups and test restores
• Enforce MFA on all remote access and privileged accounts
• Alert on use of Mimikatz, PsExec, Impacket, rclone, Advanced Port Scanner and SoftPerfect Netscan
• Alert on tools that disable security software (HRSword, PCHunter, Process Hacker)
• Train users to recognize and report phishing and spam

Affected and fixed versions

• Unknown — Victim organization 'Capetown' (identity, sector and country not stated by the source)

Timeline

• 2021-11-03 ransomware.live records the earliest estimated attack date for a MedusaLocker leak-site victim.
• 2022-06-30 CISA, FBI, Treasury and FinCEN publish joint advisory AA22-181A on MedusaLocker (revised 2022-08-11).
• 2022-11-15 ransomware.live records the group's discovery date for its first leak-site victim listing.
• 2024-10-03 Cisco Talos publishes research on an actor spreading the MedusaLocker variant BabyLockerKZ.
• 2026-11-04 ransomware.live shows other recent MedusaLocker victims (Msn, Dian, baiapai, Vinitgloves, Jatl) dated 2026-11-04.
• 2026-11-10 ransomware.live discovers the 'Capetown' MedusaLocker leak-site listing at 22:57 UTC; the group is shown as active.
• 2026-11-10 Estimated attack date for the 'Capetown' listing per ransomware.live; the victim identity is unverified.

Sources cited

• CISA/FBI/Treasury/FinCEN Joint Advisory AA22-181A: #StopRansomware: MedusaLocker CISA · Government advisory · 2022-06-30
• FBI IC3 copy of the MedusaLocker advisory (PDF) ic3.gov · Advisory · 2022-06-30
• ransomware.live victim entry: Capetown (Medusalocker) ransomware.live · Research · 2026-11-10
• ransomware.live group page: Medusalocker ransomware.live · Research · 2026-11-10
• Cisco Talos: Threat actor believed to be spreading new MedusaLocker variant since 2022 Cisco Talos · Vendor report · 2024-10-03
• KnowBe4: New FBI and CISA alert, this ransomware strain uses RDP flaws to hack into your network blog.knowbe4.com · Blog
• Cybersecurity Dive: FBI, CISA warn of MedusaLocker ransomware cybersecuritydive.com · News · 2022-06-30

More in ransomware

• Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)
• Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%
• Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team
• Vortex ransomware group claims Scripps (US healthcare) on leak site
• Vanderbilt University hit in BYOD ransomware attack, data theft claimed

More from MedusaLocker

• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months
• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
• France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
• Identity Attacks Overtake Exploits as Top Ransomware Cause (Sophos State of Ransomware 2026)