Our MedusaLocker3 Decryptor — Advanced, Secure, and Analyst-Driven
Our cybersecurity specialists have engineered a bespoke decryptor to assist victims of the MedusaLocker3 / Far Attack ransomware family — an evolution of the notorious MedusaLocker threat group. This version encrypts files using AES and RSA hybrid encryption, appending the “.BAGAJAI” extension to each locked file.
Safely analyze encrypted samples inside a controlled forensic sandbox;
Identify specific MedusaLocker3 build variants and unique victim IDs; and
Restore encrypted files through a validated, logged decryption sequence that preserves forensic evidence.
The decryptor supports both cloud-based key recovery and offline execution for restricted or air-gapped environments. Each operation begins with read-only verification, ensuring no data corruption or evidence alteration before recovery starts.
Once a few encrypted samples and ransom notes are submitted, our decryptor conducts a deep inspection of encryption headers and internal structures to identify the variant. Using this fingerprint, we check against known MedusaLocker3 and Far Attack encryption patterns.
If a recoverable key structure is found, a Proof-of-Concept (PoC) decryption is performed on 1–2 files. Once successful, we execute full recovery while generating audit trails suitable for insurers and compliance teams.
Requirements for running the decryptor:
Ransom note: read_to_decrypt_files.html
Two to five encrypted files (copies only) with the .BAGAJAI extension
Administrative privileges on the target host or recovery machine
Internet connectivity for cloud analysis (optional if using offline mode)
Immediate Actions After Discovering MedusaLocker3 Infection
Disconnect affected systems immediately. Unplug Ethernet cables, disable Wi-Fi, and sever access to shared or network drives to prevent the ransomware from propagating.
Preserve encrypted files exactly as found. Avoid renaming, deleting, or opening any .BAGAJAI files — this may break internal file associations used for decryption.
Capture system memory (RAM) if possible. Memory dumps may contain encryption keys or traces of the MedusaLocker3 process.
Collect forensic data. Archive AV/EDR logs, Windows event records, and firewall or proxy logs for incident review.
Engage experts. Contact a qualified ransomware recovery team — do not email the attackers at recovery1@amniyat.xyz or recovery1@salamati.vip.
Recovery Options for .BAGAJAI Files
Free Recovery Options
Offline/Immutable Backups: If you have backups isolated from the infected network, restore them after verifying integrity using checksum validation. MedusaLocker3 typically targets connected or mapped backup devices.
VM or Cloud Snapshots: Rollback to a secure virtual or cloud snapshot created before the infection. Always confirm that snapshots were not encrypted or deleted.
Paid / Professional Recovery
Analyst-Driven Decryptor Service: Our decryptor workflow begins with a small-scale PoC decryption before proceeding to full recovery. All steps are monitored and logged.
Ransom Payment (Not Recommended): While some victims have recovered through payment, there is no guarantee of obtaining a functional decryptor. MedusaLocker3 employs strong AES/RSA encryption, and law enforcement discourages paying ransoms due to potential funding of further attacks.
How to Use Our MedusaLocker3 Decryptor — Step-by-Step?
Assess the Infection Identify encrypted files ending in .BAGAJAI and verify the ransom note read_to_decrypt_files.html is present in affected folders.
Secure the Environment Disconnect compromised systems from networks and storage devices to prevent ongoing encryption or data exfiltration.
Engage Our Recovery Team Submit encrypted samples and ransom notes for variant confirmation. Our team will analyze and provide a personalized recovery plan.
Run Our Decryptor Launch the MedusaLocker3 Decryptor as an administrator. Internet access may be needed if cloud validation is used.
Enter Your Victim ID Locate the Victim ID listed in the ransom note and input it into the decryptor for accurate mapping to your encryption session.
Start the Decryptor Initiate the process to restore files to their original state. The tool produces integrity logs and verification reports during operation.
Understanding MedusaLocker3 / Far Attack Ransomware
Overview MedusaLocker3, sometimes called Far Attack, is a new generation of the MedusaLocker family known for its secure encryption and double-extortion tactics. It appends “.BAGAJAI” to encrypted files and drops an HTML ransom note titled read_to_decrypt_files.html.
Behavior The ransomware encrypts common file types, including documents, databases, images, and archives. It deletes Volume Shadow Copies and disables Windows recovery utilities to block restoration. The ransom note instructs victims to contact the attackers via email (recovery1@amniyat.xyz, recovery1@salamati.vip) or through Tor gateways.
Propagation Methods MedusaLocker3 commonly spreads via phishing emails, RDP brute-force attacks, malicious attachments, or exploitation of public-facing services. It has also been observed using droppers that deploy password-stealing trojans like Mimikatz alongside the encryptor payload.
YOUR PERSONAL ID: G/3NxB6AYV+wKW7BXpnnva+Yl1DzR6MyoSKr7Y0ErXVBs6yi62sTwkmmkaHXimnEE10UQIvmkE1R4JTyfH+Pb6Z9i3NsagO6WIJfuF+14KdFXJAEAbhH9z0avE6jkze5ttvRZ7dZgNc4cRawC6tYkMBzyg5LpHCSdfEmSbeDb696O4rAEjMiSM0tDXa6VZuGaxoVsnAjC/aqJF9JS+qb6Ccd/8apyOFcqXCGCQkIkWeP6aN7bsXyOCxXBNGnCSlbJTqMLEd/u2bL33sVnWYlk/N5Hph9ndQloaML5nG0naxfqVQ/1lTEyewdbXpFRHoi1oWwBiqmddMnGCwIIAE+Gg==
YOUR CORPORATE NETWORK HAS BEEN COMPROMISED & ENCRYPTED
Your files have been secured using military-grade encryption (RSA-4096 + AES-256).
WARNING: Any attempt to restore files with third-party software or to modify/rename encrypted files may cause permanent data corruption. Do not alter encrypted files.
We have successfully infiltrated your network and encrypted critical data. Compromised information — including confidential documents, financial records, and personal data — is stored on our private servers. That server will be permanently destroyed upon confirmation of payment. Failure to comply may result in public disclosure of all data to media outlets and data brokers.
We are motivated by financial gain, not destruction. To prove our capability, we will decrypt 2–3 non-critical files free of charge as verification.
Contact us immediately to obtain pricing and the decryption software:
Impact: Encrypts core data, prevents restoration, and may leak exfiltrated information.
Victim Landscape
Regions Affected:
Industries Targeted:
Timeline of Activity:
Conclusion
MedusaLocker3 (Far Attack Ransomware) is among the most recent variants of the MedusaLocker ransomware family, using advanced encryption and credential theft to maximize damage. Victims should:
Isolate infected systems immediately.
Preserve encrypted data, ransom notes, and logs.
Use trusted decryptor services that provide proof-of-concept results before committing.
Avoid paying ransoms unless legally advised.
To prevent recurrence, maintain patched systems, restrict RDP access, enforce MFA, and follow the 3-2-1 backup strategy (three copies, two media types, one offline).
Frequently Asked Questions
Currently, no public decryptor exists for MedusaLocker3. Monitor official projects such as No More Ransom fornew releases.
It uses a hybrid system combining AES-256 and RSA-2048, making brute-force decryption impossible.
The ransomware spreads through phishing attachments, vulnerable RDP ports, or malicious downloads.
No. Payments don’t guarantee decryption and encourage further criminal activity.
Associated payloads such as Mimikatz, Chisel, and LostMyPassword.exe have been observed stealing credentials and spreading laterally.
Implement strong RDP security (VPN + MFA), apply system updates, disable unnecessary remote services, and use offline or immutable backups.
Contact Us To Purchase The MedusaLocker3 / Far Attack Decryptor Tool
Overview The emergence of Forgive ransomware has significantly altered the cybersecurity landscape. This malicious software is capable of breaching systems, encrypting essential data, and demanding ransom in exchange for file access. With attacks becoming increasingly frequent and more complex, the process of retrieving lost data has become a pressing concern for both individuals and enterprise-level…
Our Kryptos Decryptor: Rapid Recovery, Expert-Engineered We provide an enterprise-grade incident and recovery offering tailored for Kryptos incidents. Our approach combines forensic analysis, safe sample handling, and proven recovery techniques to maximize the chance of full restoration while minimizing further harm to your environment. We do not run untrusted third-party tools on production systems —…
Expert-Built Salted2020 Decryptor: Safe Recovery for Businesses Salted2020 ransomware is a dangerous encryption-based threat that locks files with the .salted2020 extension. Our security research team has reverse-engineered samples of Salted2020 and developed a specialized decryptor to restore encrypted data without paying criminals. This solution works across Windows, Linux, and VMware ESXi systems and has already…
Our Phantom Ransomware Decryptor — Professionally Built and Forensically Safe Our research and incident response team has developed a custom decryptor for Phantom ransomware, an evolved threat derived from the open-source Hidden Tear project. Phantom uses strong hybrid encryption (AES-256 and RSA-2048) and adds the “.Phantom” extension to locked files. The decryptor is designed to:…
Introduction The emergence of Buhti ransomware has significantly impacted the cybersecurity landscape, as it infiltrates systems, encrypts vital files, and demands ransom in exchange for decryption keys. As a variant of the LockBit 3.0/Babuk-based ransomware group, Buhti ransomware poses a substantial threat to individuals and organizations alike. The frequency and sophistication of these attacks have…
The DEVMAN 21 ransomware represents a significant threat to both individuals and organizations, combining file encryption with the malicious exfiltration of sensitive data. Identified by its distinctive .devman21 file extension and the !!!_README_!!!.txt ransom note it leaves behind, this malware can bring productivity to a grinding halt. For a long time, victims faced the grim…
3 Comments