# MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)

> ransomware.live lists 'Capetown' as a new victim of the MedusaLocker ransomware group, discovered 2026-11-10 22:57 UTC with an estimated attack date of 2026-11-10. The victim's country and sector are not stated, and the entry's description text names DSV, a logistics company, which does not match the victim name, so the victim identity is unverified.

- **Published:** 2026-11-10T23:25:35Z
- **Last reviewed:** 2026-11-10T23:25:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5692
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5692.png
- **ID:** TL-2026-5692
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** MedusaLocker
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

This record tracks a leak-site listing, not a confirmed incident. The ransomware.live tracker entry for 'Capetown' attributes the listing to the MedusaLocker group, with a discovery timestamp of 2026-11-10 22:57 UTC and an estimated attack date of 2026-11-10. The entry states no country or sector and lists no website, IOCs or ransom amount. Its description block is a generic text about a logistics company offering sea, air and road freight, warehousing and customs services, and it names that company as DSV. That does not match the victim name 'Capetown', so it is not possible to say which organization, if any, was actually compromised. Treat the identity, sector and geography as unverified, and do not assume that DSV was breached. The entry carries one leak screenshot, and other recent MedusaLocker entries on the tracker (Msn, Dian, baiapai, Vinitgloves, Jatl) are dated 2026-11-04.

Background on the group comes from ransomware.live's group profile and public reporting. MedusaLocker was the subject of the joint CISA/FBI/Treasury/FinCEN advisory AA22-181A (published 2022-06-30, revised 2022-08-11). The advisory says actors mainly gain initial access through vulnerable RDP configurations (T1133), and also through phishing and spam campaigns that sometimes attach the ransomware directly (T1566). A batch file runs a PowerShell script (invoke-ReflectivePEInjection) that spreads the malware across the network. The ransomware copies itself as svhost.exe or svhostt.exe to %APPDATA%\Roaming and creates a scheduled task that runs it every 15 minutes. It edits the EnableLinkedConnections registry value and restarts LanmanWorkstation to enable network-wide host and share discovery. It restarts the machine in safe mode, deletes local backups and shadow copies, and disables startup recovery options. It kills processes of security, accounting and forensic software, and encrypts files with AES-256, with the AES key protected by an RSA-2048 public key. Ransom notes such as HOW_TO_RECOVER_DATA.html are dropped, and the advisory assesses the model as ransomware-as-a-service with an affiliate/developer payment split of 55-60% to the affiliate.

Cisco Talos (2024-10-03) documented a related actor spreading a MedusaLocker variant called BabyLockerKZ. It uses the same chat and leak sites as MedusaLocker and carries PAIDMEMES registry keys. Its toolset includes a credential checker bundling RDP Plus, PsExec, Mimikatz and Invoke-TheHash, a MIMIK wrapper around Mimikatz and rclone, and public tools such as HRSword, Advanced Port Scanner, SoftPerfect Netscan, Process Hacker and PCHunter. The ransomware.live group profile lists the same tools, plus Impacket and Parent PID Spoofing. Talos assessed with medium confidence that this actor is financially motivated. The profile shows 122 listed victims across 28 countries as of 2026-11-10, with manufacturing, technology and professional services as the top sectors. Whether the Capetown listing involves BabyLockerKZ-style tooling is not stated by any source, and no technical detail is inferred for this specific victim. The group page's description block describes the unrelated 'Medusa' DDoS botnet and should not be used for MedusaLocker analysis. MedusaLocker is also unrelated to the Medusa ransomware covered in CISA advisory AA25-071A.

## MITRE ATT&CK

- T1133 External Remote Services
- T1566 Phishing
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1569.002 System Services: Service Execution
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1134.004 Access Token Manipulation: Parent PID Spoofing
- T1688 Safe Mode Boot
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1003.001 OS Credential Dumping: LSASS Memory
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Mimikatz Execution, LSASS Access, SAM/Secrets Dumping and Pass-the-Hash (MedusaLocker / BabyLockerKZ Credential Theft)** (`TL-2026-5692-SPL-003`)

Detects Mimikatz command-line modules and suspicious LSASS process access, the credential theft tooling Cisco Talos and ransomware.live attribute to MedusaLocker and the BabyLockerKZ variant (credential checker and MIMIK wrapper). Covers T1003.001 for MedusaLocker TL-2026-5692.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1003.002, T1550.002
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=10 TargetImage="*lsass.exe" GrantedAccess IN ("0x1010", "0x1410", "0x1438", "0x143a", "0x1fffff") NOT SourceImage IN ("*MsMpEng.exe", "*MsSense.exe", "*csrss.exe", "*wininit.exe", "*WerFault.exe", "*vmtoolsd.exe")) OR (EventCode=1 (CommandLine="*sekurlsa::*" OR CommandLine="*lsadump::*" OR CommandLine="*privilege::debug*" OR CommandLine="*kerberos::ptt*" OR Image="*mimikatz*" OR OriginalFileName="mimikatz.exe")))
| eval signal=case(EventCode=10,"lsass_access", like(lower(CommandLine),"%sekurlsa::pth%") OR like(lower(CommandLine),"%kerberos::ptt%"),"pass_the_hash_or_ticket", like(lower(CommandLine),"%lsadump::sam%") OR like(lower(CommandLine),"%lsadump::secrets%") OR like(lower(CommandLine),"%lsadump::dcsync%"),"credential_database_dump", true(),"mimikatz_command_line")
| stats count values(signal) as signals values(SourceImage) as source_images values(GrantedAccess) as access_masks values(CommandLine) as command_lines min(_time) as first_seen by host
| convert ctime(first_seen)
```

### Microsoft KQL

```kql
union
(DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex "(?i)sekurlsa::|lsadump::|privilege::debug|kerberos::ptt" or FileName =~ "mimikatz.exe" or ProcessVersionInfoOriginalFileName =~ "mimikatz.exe"
    | extend Source = case(ProcessCommandLine matches regex "(?i)sekurlsa::pth|kerberos::ptt", "pass_the_hash_or_ticket", ProcessCommandLine matches regex "(?i)lsadump::(sam|secrets|dcsync)", "credential_database_dump", "process")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Source),
(DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "OpenProcessApiCall" and AdditionalFields has "lsass.exe"
    | where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MsSense.exe", "csrss.exe", "wininit.exe", "WerFault.exe", "vmtoolsd.exe")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, Source = "lsass_access")
```

### Sigma

```yaml
title: Mimikatz Command-Line Modules Used by MedusaLocker Affiliates
id: c3a7d915-4e08-4f6b-a1d2-9e5b8f3c7603
status: experimental
description: Detects Mimikatz module invocations (sekurlsa, lsadump, privilege::debug, kerberos::ptt) or a mimikatz.exe image, matching the credential theft tooling attributed to MedusaLocker and BabyLockerKZ.
references:
    - https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/
    - https://www.ransomware.live/group/medusalocker
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.002
    - attack.lateral-movement
    - attack.t1550.002
    - attack.s0002
    - attack.tool.mimikatz
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        CommandLine|contains:
            - 'sekurlsa::'
            - 'lsadump::'
            - 'privilege::debug'
            - 'kerberos::ptt'
    selection_image:
        Image|endswith: '\mimikatz.exe'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or penetration testing exercises
level: critical
```

**Known false positives:**

- Authorized red team or penetration test using Mimikatz
- Endpoint security or backup agents that open LSASS with the listed access masks and are not yet in the exclusion list

**Tuning notes:** Extend the SourceImage exclusion list with your EDR and monitoring agents (validate by full path and signer). Renamed Mimikatz binaries are still caught by the command-line modules and LSASS access signal. Requires Sysmon EventCode 10 for the LSASS access branch; scope Sysmon config to LSASS targets to keep volume low.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- External RDP Logon After Repeated Failures from a Public IP (MedusaLocker Initial Access) (locked: unlock with TL Creds)
- Security Software Tampering: HRSword, PCHunter, Process Hacker and Security/Business Service Stops (locked: unlock with TL Creds)
- MedusaLocker Lateral Movement and Network Discovery: PsExec, Impacket wmiexec, NetScan and Advanced Port Scanner (locked: unlock with TL Creds)
- Reflective PE Injection and Invoke-TheHash PowerShell Script Blocks (locked: unlock with TL Creds)
- MedusaLocker Registry Tampering: EnableLinkedConnections and PAIDMEMES Keys (locked: unlock with TL Creds)
- MedusaLocker Ransom Note [indicator] and Masqueraded svhost Binary File Creation (locked: unlock with TL Creds)
- MedusaLocker [indicator] / [indicator] Roaming Persistence and 15-Minute Scheduled Task (locked: unlock with TL Creds)
- MedusaLocker Recovery Inhibition: Shadow Copy Deletion, Startup Recovery Disable and Safe Mode Boot (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `95.143.191[.]148`
- Domain: `qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd[.]onion`
- File hash: `012657c4548d9c98223caa4cc7aa52fc083d6983d42fde16ca3271412e7fe3fe`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim entry: Capetown (Medusalocker)](https://www.ransomware.live/id/Q2FwZXRvd25AbWVkdXNhbG9ja2Vy)
- [ransomware.live group page: Medusalocker](https://www.ransomware.live/group/medusalocker)
- [CISA/FBI/Treasury/FinCEN Joint Advisory AA22-181A: #StopRansomware: MedusaLocker](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-181a)
- [FBI IC3 copy of the MedusaLocker advisory (PDF)](https://ic3.gov/CSA/2022/220630.pdf)
- [Cisco Talos: Threat actor believed to be spreading new MedusaLocker variant since 2022](https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/)
- [Cybersecurity Dive: FBI, CISA warn of MedusaLocker ransomware](https://cybersecuritydive.com/news/fbi-cisa-medusalocker-ransomware/626483/)
- [KnowBe4: New FBI and CISA alert, this ransomware strain uses RDP flaws to hack into your network](https://blog.knowbe4.com/new-fbi-and-cisa-alert-this-ransomware-strain-uses-rdp-flaws-to-hack-into-your-network)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5692