What is Medusa, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) warn about a dangerous ransomware scam.
In an advisory published earlier this week, government officials warned that a “ransomware-as-a-service” operation called Medusa, which has been launching attacks with this type of software since 2021, has recently affected hundreds of people.
Medusa uses phishing campaigns as its primary method to steal victims’ identification credentials, according to CISA.
To protect against this threat, officials recommend updating operating systems, software, and firmware, as well as using multi-factor authentication for all services, such as email and VPNs.
Experts also advise using long passwords and warn that passwords should not be changed too frequently, as this can weaken security.
Medusa’s developers and affiliates—known as “Medusa actors”—use a double extortion model, where “they encrypt victims’ data and threaten to publicly release the stolen data if a ransom is not paid,” the advisory states.
Medusa operates a data leak site that displays victims alongside countdown timers for information release.
“Ransom demands are posted on the site, with direct hyperlinks to cryptocurrency wallets affiliated with Medusa,” the advisory states.
“At this stage, Medusa simultaneously advertises the sale of the data to interested parties before the countdown timer expires. Victims can also pay $10,000 in cryptocurrency to add one day to the countdown timer.”
Since February, Medusa’s developers and affiliates have targeted over 300 victims across various industries, including the medical, educational, legal, insurance, technology, and manufacturing sectors, according to CISA.
Image: T51
