You call yourselves MedusaLocker, but some researchers suggest that your current operation may be connected to names such as BAGAJAI or BARADAI. Can you explain the relationship between these names?

MedusaLocker is the name of a family of software used in attacks. BAGAJAI, BARADAI, locked, blackheart and others are file extensions attached to encrypted files so we can identify the victim and apply the correct key.

MedusaLocker is a well-known ransomware group, with 52 published victims, but the original operation appears to have become inactive since November 2025. If you are the same MedusaLocker, why does your new site not include the victims that were published on the original MedusaLocker site?

We were busy updating the software and developing a new blog and file manager for publishing files, so the old blog was not updated. I don't see the point in shoving the name MedusaLocker into every possible place. We earn our name through business, not aggressive marketing.

Does MedusaLocker define itself primarily as a financially motivated organization, a politically motivated organization, or a mix of both?

Yes, we are financially oriented. We do not pursue any political goals.

Where does MedusaLocker draw the line when choosing targets? Are there specific sectors or organizations you refuse to attack for moral, ethical, or humanitarian reasons?

We do not work with socially significant organizations, such as social welfare organizations. If we get access to such an organization, we notify them about the vulnerability for free.

For some of the victims listed on your site, the ransom demand is visible, usually ranging between $10,000 and $80,000. How do you decide the ransom amount for each victim?

This is the price for selling information, which includes an assessment of the potential harm to the company itself, as well as the value of the data. For example, CourtSmart even has the SSN numbers of all their employees, including those who have been laid off. We contacted the organization in various ways, but they apparently did not care about their employees or their profits. In any case, we are ready to negotiate a price and make some concessions.

Does MedusaLocker use double extortion, meaning both encryption and data exfiltration, or do you sometimes use only one of these methods?

I would not call this 'double' extortion, as these are all parts of the same chain. First of all, we discover a vulnerability in the system, and everything else is a consequence. Sometimes it does not make sense to copy data or carry out full encryption, so we limit ourselves to one thing. We consider the so-called 'ransom' to be a reward for our work.

If you do not encrypt a company's servers, how do you deliver the ransom note and make sure the victim actually sees it?

As a rule, this is done through an email campaign or a call to the company. Sometimes we send our representative if the company is ready for negotiations. There are situations when we fail to reach the management of the organization, such as with CourtSmart. Then we just publish the data. I am sure they will feel it.

The FBI and global law enforcement agencies have disrupted many ransomware operations in recent years. How has this pressure affected the way ransomware groups operate today? Are you concerned that MedusaLocker could become a law enforcement target?

Everything that happens is quite understandable, logical and expected. The only thing that worries us is the lies from law enforcement and similar agencies, including all kinds of cybersecurity organizations, claiming that the company will not receive anything even if it pays. We invest a lot of money in improving data decryption approaches, adding file integrity protection and similar features, but we are considered scammers precisely because of law enforcement agencies. It is doubly disappointing that they do this with their own hands and at the expense of the organizations themselves.

What is the strangest or most unexpected request you have ever received from a victim during negotiations?

In fact, everything is very monotonous. Negotiations usually begin with a story about how hard life is for everyone, and how a company with a turnover of, for example, more than $100 million cannot find $50,000 to pay us. Then they hide behind illnesses, children who do not exist, as it turns out later, and the like. Therefore, for me, the strangest question was: 'How much and where should we transfer the money?' And they transferred it without further discussion.

How is the adoption of AI technologies changing the ransomware ecosystem? Is MedusaLocker using machine learning or generative AI in any part of its activity?

No, we do not use machine learning in our work.

Every individual, even on unconventional paths, draws inspiration from somewhere. Is there a particular book, film, or public figure that shaped your worldview or influenced your approach?

In fact, the current political situation, almost all over the world, gives us more and more inspiration. These crazy guys from America, Europe, Iran and other countries simply have no equal. They sacrifice lives for money, continue to lie to their people and rob them. Against their background, we are doing something good, trying to make the cyber world safer.

Do you have any final words or message you would like to share with my 40,000 followers?

Do not skimp on your safety.