Test

Deanonymizing Medusa Ransomware's Onion Site

Apr 14, 2025By Covert Security

It's not just the bad guys that can hack - our team recently uncovered the real IP address of the server hosting Medusa Locker's blog and negotiation site, by exploiting a vulnerability in their blog.

Medusa Locker primarily targets healthcare, education, and manufacturing sectors, with hundreds of reported attacks since its emergence in 2019. The group operates a Tor-based leak site to pressure victims, where they publish stolen data from organizations that refuse to pay.

๐Ÿงจ After uncovering a high severity vulnerability in Medusa Locker's ransomware blog - we successfully escalated and obtained the true IP address of their hidden host.

Figure 1 - Censys results and real site exposed.

๐Ÿ“ Our analysis reveals that the server is located in Saint Petersburg, Russia, hosted by Selectel, one of the largest Russian providers, known for accepting payments in Bitcoin and Litecoin.

โณ ๐˜๐˜ฐ๐˜ญ๐˜ญ๐˜ฐ๐˜ธ ๐˜ฐ๐˜ถ๐˜ณ ๐˜ฑ๐˜ข๐˜จ๐˜ฆ ๐˜ต๐˜ฐ ๐˜ด๐˜ต๐˜ข๐˜บ ๐˜ถ๐˜ฑ๐˜ฅ๐˜ข๐˜ต๐˜ฆ๐˜ฅ ๐˜ง๐˜ฐ๐˜ณ ๐˜ฎ๐˜ฐ๐˜ณ๐˜ฆ ๐˜ฆ๐˜น๐˜ฑ๐˜ฐ๐˜ด๐˜ฆ๐˜ด, ๐˜ข๐˜ฏ๐˜ฅ ๐˜ต๐˜ฐ ๐˜ฃ๐˜ฆ ๐˜ต๐˜ฉ๐˜ฆ ๐˜ง๐˜ช๐˜ณ๐˜ด๐˜ต ๐˜ต๐˜ฐ ๐˜ฌ๐˜ฏ๐˜ฐ๐˜ธ ๐˜ข๐˜ฃ๐˜ฐ๐˜ถ๐˜ต ๐˜ฐ๐˜ถ๐˜ณ ๐˜ถ๐˜ฑ๐˜ค๐˜ฐ๐˜ฎ๐˜ช๐˜ฏ๐˜จ ๐˜ข๐˜ฅ๐˜ท๐˜ข๐˜ฏ๐˜ค๐˜ฆ๐˜ฅ ๐˜ฅ๐˜ข๐˜ณ๐˜ฌ ๐˜ธ๐˜ฆ๐˜ฃ ๐˜ช๐˜ฏ๐˜ต๐˜ฆ๐˜ญ๐˜ญ๐˜ช๐˜จ๐˜ฆ๐˜ฏ๐˜ค๐˜ฆ ๐˜ค๐˜ฐ๐˜ถ๐˜ณ๐˜ด๐˜ฆ!