Medusa Ransomware Attacks on Critical Infrastructure: Over 300 Victims Identified
This ransomware-as-a-service (RaaS) variant has impacted over 300 organizations across various critical infrastructure sectors, including healthcare, education, legal, insurance, technology, and manufacturing, as of February 2025.
First identified in June 2021, Medusa initially operated as a closed ransomware group but has since evolved to an affiliate model. Despite this change, key operations like ransom negotiations remain centrally controlled by the developers. Medusa employs a double extortion tactic, encrypting victim data and threatening to publicly release exfiltrated information if the ransom is not paid.
Investigations reveal that Medusa actors often gain initial access through phishing campaigns and the exploitation of unpatched software vulnerabilities, such as the ScreenConnect authentication bypass (CVE-2024-1709) and Fortinet EMS SQL injection flaw (CVE-2023-48788). Once inside a network, they utilize legitimate administrative tools like PowerShell and Windows Management Instrumentation (WMI) to evade detection, move laterally, and deploy the ransomware payload.
Key Tactics and Techniques:
Living off the Land (LOTL): Using built-in operating system tools for malicious activities.
Exploitation of Vulnerabilities: Targeting known weaknesses in software.
Phishing: Deceiving users to gain access or credentials.
Lateral Movement: Spreading from the initial point of compromise to other systems using tools like Remote Desktop Protocol (RDP) and PsExec.
Data Exfiltration: Stealing sensitive information before encryption using tools like Rclone.
Bring Your Own Vulnerable Driver (BYOVD): Leveraging legitimate but vulnerable drivers to disable security software.
Use of Legitimate Remote Access Software: Such as AnyDesk, Atera, ConnectWise, and Splashtop, to blend in with normal activity.
Mitigation Recommendations:
Patch Management: Ensure all operating systems, software, and firmware are patched and up to date.
Network Segmentation: Implement network segmentation to limit the spread of ransomware.
Network Traffic Control : Filter network traffic to prevent unauthorized access to remote services, unusual network activity and restrict the use of RDP
Identity and Access: Enforce strong access controls and multi-factor authentication (MFA).
Backup Plan: Regularly maintain offline backups of critical data.
Deploy and Maintain Endpoint Detection and Response (EDR) Solutions: EDR tools provide comprehensive visibility into endpoint activity, enabling the detection of suspicious behaviours.
Privilege control : Disable command-line and scripting activities and permissions where appropriate.
Develop and Maintain an Incident Response Plan: Establish a comprehensive incident response plan that outlines the procedures for detecting, containment, eradicating, and recovering from security incidents