MedusaLocker Ransom Note Drop Across Multiple Directories

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•8

Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.