Threat actor believed to be spreading new MedusaLocker variant since 2022

Category	Details
Threat Actors	Financially motivated group, possibly an Initial Access Broker (IAB) or affiliate of a ransomware cartel.
Campaign Overview	Deployment of a MedusaLocker ransomware variant (“BabyLockerKZ”) with activity since at least 2022, targeting victims worldwide.
Target Regions	Initially Europe (e.g., France, Germany, Spain, Italy); shifted focus to Latin America (e.g., Brazil, Mexico, Argentina, Colombia) from mid-2023.
Methodology	Use of publicly known tools and custom tools (e.g., “Checker”); credential theft, lateral movement, ransomware deployment.
Product Targeted	Organizations across various sectors; specific systems not mentioned but involved wide-scale compromises (100+ per month).
Malware Reference	MedusaLocker ransomware variant (“BabyLockerKZ”); differences include unique registry keys (e.g., PAIDMEMES).
Tools Used	Publicly known tools (e.g., Mimikatz, ProcessHacker, Advanced Port Scanner), custom tools (e.g., “Checker”), and LoLBins for credential theft.
Vulnerabilities Exploited	Not explicitly detailed; likely exploited weaknesses in credential handling and lateral movement capabilities.
TTPs	– Consistent storage paths for attack tools. – Use of pass-the-hash techniques. – GUI-based management of credentials and IP scanning tools.
Attribution	Financially motivated group using MedusaLocker; likely an IAB or affiliate of a ransomware cartel.
Recommendations	– Deploy robust endpoint detection and response solutions. – Block malicious domains, IPs, and URLs. – Use multi-factor authentication. – Update security rules and monitor traffic.
Source	Talos Blog

Read full article: Read More
Disclaimer: The above summary has been generated by an AI language model.