Summary: A joint alert from CISA, FBI, and MS-ISAC warns of rising Medusa ransomware attacks, a ransomware-as-a-service (RaaS) variant impacting various critical infrastructure sectors. Since its emergence in 2021, Medusa has targeted over 300 victims, employing double extortion tactics and leveraging initial access brokers to gain entry to networks. Organizations are encouraged to prioritize mitigation strategies and adopt an ‘assumed breach’ mindset to enhance their cybersecurity resilience.
Affected: Various critical infrastructure sectors (healthcare, law, education, insurance, technology, manufacturing)
Keypoints :
- Medusa ransomware operates as a RaaS, impacting over 300 victims since 2021.
- Ransom demands range from 0,000 to million, using double extortion tactics.
- Initial access brokers exploit networks through phishing campaigns and vulnerabilities.
- Mitigation recommendations include software patches, network segmentation, and an ‘assumed breach’ mindset.