# Medusa Ransomware: A Growing Threat to Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have issued a joint advisory, warning that the Medusa ransomware operation has had a significant impact on over 300 victims across critical infrastructure sectors. The affected industries include healthcare, education, legal, insurance, technology, and manufacturing.

Medusa, a ransomware-as-a-service (RaaS) variant first identified in June 2021, employs a double extortion model – encrypting victim data while also threatening to publicly release exfiltrated data if the ransom is not paid. Despite its name, Medusa ransomware is unrelated to MedusaLocker or the Medusa mobile malware variant.

## How Medusa Ransomware Operates

The FBI's investigation found that Medusa actors gain initial access through phishing campaigns and by exploiting unpatched software vulnerabilities, such as the ScreenConnect authentication bypass (CVE-2024-1709) and Fortinet EMS SQL injection flaw (CVE-2023-48788). Once inside a network, they use legitimate administrative tools, including PowerShell and Windows Management Instrumentation (WMI), to evade detection, move laterally, and deploy encryption payloads.

Medusa affiliates utilize various remote access tools such as AnyDesk, Atera, and ConnectWise to infiltrate networks. They also employ advanced techniques to evade detection, including obfuscated PowerShell scripts, disabling endpoint detection systems, and leveraging reverse tunneling tools like Ligolo and Cloudflared.

## Extortion Tactics: A Threat to Organizations

A particularly alarming aspect of Medusa's operations is its extortion tactics. Victims are pressured to pay within 48 hours via a Tor-based live chat or encrypted messaging platforms. If ignored, Medusa actors leak stolen data on their darknet site, offering it for sale before the countdown timer expires.

Reports suggest that even after a ransom is paid, victims may face additional extortion demands from different Medusa actors. This highlights the importance of organizations taking proactive measures to protect themselves against such attacks.

## Recommendations from CISA and Expert Advice

The advisory strongly recommends that organizations implement mitigations to prevent falling victim to an attack, including:

"This continues CISA's long tradition of warning people about ransomware that spreads using social engineering," noted Roger Grimes, a cybersecurity expert from KnowBe4. "Security awareness training is not sufficient to defeat it."

## The Risks of Paying Ransom

Regardless of the recommendations, the FBI and CISA urge organizations to report Medusa ransomware incidents to law enforcement and refrain from paying ransoms. Doing so risks encouraging further attacks.

Hackers must be laughing," said Grimes. "Ignoring social engineering is a huge disservice... Hackers must be laughing."

In conclusion, Medusa ransomware poses a significant threat to critical infrastructure, particularly those in healthcare, education, legal, insurance, technology, and manufacturing sectors. Organizations must take proactive measures to protect themselves against such attacks, including implementing security awareness training and avoiding payment of ransoms.

Stay vigilant and stay informed.