MEDUSA Ransomware Group Seeks Millions in Ransom Payments

Published:

MEDUSA Ransomware Strikes Again: New Victims Targeted

The notorious MEDUSA ransomware group has resurfaced once again, this time targeting three new victims: GEMCO Constructors, Dynamo Electric, and Farnell Packaging. The group’s dark web portal has listed these companies as the latest additions to their growing list of victims.

Demanding a hefty sum of US $900,000 from GEMCO and $100,000 each from Dynamo and Farnell Packaging, the ransomware group has threatened to leak the internal data of these organizations if the ransom is not paid.

GEMCO Constructors, based in Indianapolis, Indiana, USA, is facing the threat of 1.0 TB of data being published within 6-7 days. Meanwhile, Dynamo Electric in Saskatchewan, Canada, and Farnell Packaging, a Canadian company in the packaging industry, have also allegedly been compromised, with 149.6 GB and 193.9 GB of data accessed, respectively.

Despite these claims by the MEDUSA ransomware group, the official websites of the targeted companies remain operational, with no apparent signs of a cyberattack. The organizations have not yet responded to the allegations, leaving the situation unverified.

This latest attack adds to MEDUSA’s track record of targeting organizations across various industries and countries since its emergence in June 2021. Operating as a Ransomware-as-a-Service platform, the group provides malicious software and infrastructure for ransomware attacks.

As organizations grapple with the aftermath of cyberattacks like those orchestrated by MEDUSA, the importance of robust security measures and vigilance in the face of such threats cannot be understated.

CHAPTER X // CYBER AWARENESS CAMPAIGN
BEYOND THE BALLROOM
[C://ME] // CHAPTER X

REQUEST THE MEDIA KIT

Tell us where to send the Beyond the Ballroom media deck. Every field is required.

We will use these details to respond to your media-kit request. Privacy Policy

Cyber Warriors Conclave Chapter X — Beyond the Ballroom

Related articles

Recent articles

PHP addresses critical security vulnerabilities allowing potential remote code execution

PHP has released a critical security update addressing vulnerabilities that could allow attackers to execute commands on any web server running the language. This...

Critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619 identified by Unit 42

Recent findings from Unit 42 have identified critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which could allow attackers to execute arbitrary code on...

Compromised LiteLLM 1.107.0 package leads to widespread credential theft via Python startup hooks

On October 21, 2026, a compromised version of the LiteLLM 1.107.0 package was uploaded to the Python Package Index (PyPI), leading to significant credential...

FCC bans devices with surveillance chips from Huawei subsidiary HiSilicon

The Federal Communications Commission (FCC) has enacted a ban on two devices equipped with surveillance chips produced by HiSilicon, a subsidiary of the Chinese...