Threat video1:00
MedusaLocker Capetown Leak-Site Listing: Detection & IOCs
MedusaLocker lists Capetown as a victim, identity unverified. Includes 9 detection rules, 29 IOCs and 16 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for MedusaLocker ransomware leak-site listing: victim 'Capetown'… →
Chapters
- 0:00The hookA leak-site listing, not a confirmed breach.
- 0:04The storyMedusaLocker listed a victim named Capetown.
- 0:10Attack pathActors mainly enter via vulnerable RDP.
- 0:26AttributionAttributed to MedusaLocker.
- 0:30Indicators of compromise15 indicators to hunt: 1 IP, 3 domains and 8 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to impact.
- 0:44Remediation5 steps now: Do not treat the Capetown listing as a confirmed breach.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A leak-site listing, not a confirmed breach.
0:05MedusaLocker listed a victim named Capetown.
0:08Its identity is unverified.
0:11Actors mainly enter via vulnerable RDP.
0:14Then a PowerShell script spreads it.
0:16Scheduled task runs it every 15 minutes.
0:19Backups and shadow copies deleted.
0:22Capetown listed; verify first.
0:26Attributed to MedusaLocker. Confidence: medium.
0:3115 indicators to hunt: 1 IP, 3 domains and 8 SHA-256 hashes, and more.
0:3916 ATT&CK techniques, from initial access to impact.
0:445 steps now: Do not treat the Capetown listing as a confirmed breach.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.