MedusaLocker3/FarAttack Identification Details and Reported Victim Activity
Summary
The post describes MedusaLocker3/FarAttack’s file extensions, ransom notes and PERSONAL ID, and says it may be deployed with GlobeImposter 2.0. A forum user reported suspected RDP compromise, Mimikatz activity and security-tool removal before encryption.
Key points
- The post describes MedusaLocker3, also called FarAttack, as an updated Rust-based MedusaLocker variant.
- It says MedusaLocker3 may be deployed alongside GlobeImposter 2.0, with both strains sometimes using the same extensions; file-footer structure can help distinguish them.
- The post lists numerous reported extensions and ransom-note filenames associated with MedusaLocker3/FarAttack.
- Ransom notes are described as containing a long hexadecimal PERSONAL ID, typically near the top.
- A forum user reported suspected RDP compromise, Mimikatz use and removal of antivirus and Windows Defender before their files were encrypted.
- The user reported the .chipslock extension and a ransom note demanding payment; these details are an individual report, not independent confirmation of the cause or malware attribution.
Article Details
- Topic
- MedusaLocker3/FarAttack ransomware characteristics, file extensions, ransom notes, and victim-reported compromise indicators
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
uncrypt2022@outlook[.]com | Ransom-note contact address provided for communication with the ransomware operators. |
MITRE ATT&CK
T1003 · OS Credential DumpingA victim reported Mimikatz activity before encryption; the article does not specify the exact credential-dumping procedure.T1021.001 · Remote Desktop ProtocolA victim reported suspected compromise through RDP before encryption.T1562.001 · Disable or Modify ToolsA victim reported that antivirus and Win Defender were removed before encryption.
People
Andrew IvanovCredited under the alias Amigo-A for examples and information about ransomware file extensions and ransom-note PERSONAL IDs.Andrey ZhdanovCredited under the alias rivitna for information about MedusaLocker3/FarAttack file-extension patterns.Michael GillespieCredited under the alias Demonslay335 for explaining how file-footer structure can distinguish files encrypted by the two ransomware strains.
Threat Actors
Malware
GlobeImposter 2.0MedusaLocker3, also known as FarAttack, is an updated Rust-based ransomware variant that is being deployed alongside GlobeImposter 2.0, with both strains using the same file extensions in some attacks.MedusaLockerMedusaLocker3 is an updated version of MedusaLocker code.MedusaLocker3MedusaLocker3, also known as FarAttack, is an updated Rust-based ransomware variant that is being deployed alongside GlobeImposter 2.0, with both strains using the same file extensions in some attacks.