Threat actor believed to be spreading new MedusaLocker variant since 2022

# Executive summary Cisco Talos attributes a financially motivated affiliate-like threat actor active since at least 2022 that deploys a MedusaLocker variant named BabyLockerKZ, describing its credential-theft and lateral-movement toolset (including a "paid_memes" developer fingerprint), victim distribution (notably Europe then Latin America), and providing IOCs and mitigation guidance to detect and block infections.