FBI, CISA, and MS-ISAC Alert: New Medusa Ransomware Threat

In a recent joint advisory, the FBI, CISA, and MS-ISAC have issued urgent guidance on the Medusa ransomware, shedding light on its tactics, techniques, and indicators of compromise (IOCs). Based on ongoing FBI investigations as of February 2025, this advisory is part of the broader StopRansomware initiative, aiming to equip network defenders with knowledge on dealing with ransomware variants and malicious actors.

Overview of Medusa

Medusa ransomware, first identified in June 2021, has quickly evolved into a major cyber threat. According to the joint advisory, as of February 2025, Medusa’s developers and affiliates have impacted over 300 victims across various critical infrastructure sectors, including medical, education, legal, insurance, technology, and manufacturing industries. Unlike the MedusaLocker ransomware variant or Medusa mobile malware, Medusa is a distinct ransomware-as-a-service (RaaS) product, which has gained traction in the cybercriminal community.

Medusa’s developers recruit initial access brokers (IABs) from cybercriminal forums, offering payments ranging from $100 to $1 million. These brokers gain access to victims using phishing attacks and by exploiting unpatched software vulnerabilities. Specifically, Medusa operators target vulnerabilities like CVE-2024-1709 (ScreenConnect authentication bypass) and CVE-2023-48788 (Fortinet EMS SQL injection).

Tactics and Techniques: Living Off the Land

Medusa actors deploy a range of sophisticated techniques to infiltrate systems. Once they gain a foothold, they conduct reconnaissance using legitimate tools such as Advanced IP Scanner and SoftPerfect Network Scanner, scanning ports like FTP, SSH, HTTP, SQL databases, and RDP. They then move laterally within compromised networks using tools like AnyDesk, Atera, and Splashtop, while also leveraging PsExec and RDP to execute scripts and access files for exfiltration and encryption.

The operators also employ “living off the land” (LOTL) techniques, utilizing existing system tools to evade detection. For example, they use Windows Management Instrumentation (WMI) to gather system information, and certutil.exe to stealthily transfer files into the network. The attackers also obfuscate their PowerShell commands, making detection more difficult. Additionally, they disable security measures by exploiting vulnerable or signed drivers.

Medusa ransomware employs a double-extortion model, where victims are not only forced to pay to decrypt their files but are also threatened with the release of sensitive data unless a ransom is paid. The ransom note directs victims to contact the attackers via encrypted messaging platforms such as Tor or Tox. If victims don’t respond within the designated 48-hour window, Medusa actors escalate the threat, often directly contacting victims by phone or email. The ransomware also has a .onion leak site where victims’ data is posted, with countdown timers signaling when their data will be made public unless a ransom is paid. The ransom demand is also posted alongside links to cryptocurrency wallets for payment.

Medusa’s Deceptive Tactics: Triple Extortion Risk

In a particularly alarming development, FBI investigations have uncovered a possible triple extortion scheme. After a victim paid the initial ransom, a separate actor from the Medusa group contacted the victim, claiming the negotiator had stolen the initial payment and demanding half the ransom again for a “true decryptor.” This discovery suggests that Medusa ransomware operators are expanding their tactics to further exploit victims, making them highly vulnerable to additional financial extortion.

What Undercode Says: Analyzing the Medusa Ransomware Threat

Medusa ransomware represents a significant shift in how cybercriminal groups are monetizing their attacks. The shift towards a ransomware-as-a-service model—where developers provide affiliates with the tools to carry out attacks—has lowered the barrier to entry for cybercriminals, making it easier for a wide range of actors to get involved in these attacks.

The use of legitimate tools for lateral movement, reconnaissance, and encryption adds another layer of sophistication to Medusa’s attacks. This “living off the land” technique not only evades detection by traditional security solutions but also leverages existing system tools, which are often trusted by security software. This highlights the need for organizations to not only focus on detecting known malicious tools but also to implement behavior-based detection systems that can spot unusual activities even when using trusted tools.

Moreover,

Organizations need to be vigilant in applying security patches, especially for known vulnerabilities like CVE-2024-1709 and CVE-2023-48788. It’s also crucial to prioritize user education around phishing campaigns, as this is still a key entry point for many ransomware attacks. Beyond prevention, businesses should have robust backup and incident response plans in place, ensuring they can recover from attacks without having to pay the ransom.

Additionally, the prevalence of remote access tools (RATs) like AnyDesk, Atera, and Splashtop used by Medusa actors emphasizes the need for organizations to secure their remote access systems. With many employees working from home, the attack surface has grown, and securing these systems is more critical than ever.

Fact Checker Results:

The Medusa ransomware, since its emergence in June 2021, has targeted over 300 organizations across critical sectors.
Medusa is not linked to MedusaLocker or Medusa mobile malware.
The advisory highlights specific vulnerabilities exploited by Medusa, including CVE-2024-1709 and CVE-2023-48788, reinforcing the importance of timely patching.

References:

Reported By: https://securityaffairs.com/175319/cyber-crime/medusa-ransomware-hit-over-300-critical-infrastructure-organizations-until-february-2025.html
Extra Source Hub:
https://www.reddit.com/r/AskReddit
Wikipedia
Undercode AI