Medusa ransomware infects 300+, uses 'triple extortion'

A crook who distributes the Medusa ransomware tried to make a victim cough up three payments instead of the usual two, according to a government advisory on how to defend against the malware and the gangs who wield it. The joint report issued on Wednesday by the FBI, CISA, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) reminds us that Medusa is a globe-spanning ransomware-as-a-service (RaaS) operation that recruits third-party affiliates to plant ransomware and negotiate with victims once it’s encrypted data. Uncle Sam’s infosec agencies prefer to call those affiliates “Medusa actors.” They’re also sometimes labeled “initial access brokers” (IABs) because part of their job is to crack victims’ IT defenses so that systems can be infected. Whatever you call these third-party entities, they often attack with credential-stealing phishing campaigns or by exploiting unpatched software bugs. Among their favorite flaws to target are CVE-2024-1709, a critical ConnectWise ScreenConnect authentication bypass bug, and the Fortinet EMS SQL injection vulnerability CVE-2023-48788. Once Medusa miscreants get their ransomware running, they use a double extortion strategy that sees them demand payments to decrypt the scrambled data and to prevent its release. Even orgs that have good ransomware recovery regimes, meaning they don’t need to unscramble encrypted data as they have good backups and fall-back plans, may consider paying to prevent the release of their stolen da...