#StopRansomware Recap: Medusa RaaS Has Hit 300+ Critical Infrastructure Victims — Here's the Playbook
❓What:
Joint FBI/CISA/MS-ISAC advisory (AA25-071A, originally published March 2025) detailing Medusa ransomware-as-a-service (RaaS) TTPs from FBI investigations through February 2025
Medusa has operated since June 2021, evolving from a closed operation to an affiliate model, and has impacted over 300 victims across critical infrastructure sectors including medical, education, legal, insurance, technology, and manufacturing
CISA explicitly notes Medusa is unrelated to the MedusaLocker ransomware variant or the Medusa mobile malware — a common naming mix-up worth correcting when this comes up
Initial access comes via recruited initial access brokers using phishing and exploitation of unpatched CVEs, specifically the ScreenConnect authentication bypass (CVE-2024-1709) and the Fortinet EMS SQL injection flaw (CVE-2023-48788)
Heavy reliance on living-off-the-land tooling (PowerShell, WMI, certutil) plus legitimate remote access software (AnyDesk, Atera, ConnectWise, SimpleHelp, Splashtop, etc.) to blend in and evade EDR
Data exfiltrated via Rclone; encryption performed by a payload called gaze.exe using AES-256, appending a .medusa extension after deleting shadow copies and killing backup/security services
Double-extortion model with a 48-hour response window; one victim was contacted after paying and told the negotiator had stolen the funds, with half the ransom demanded again for the "true decryptor" — CISA flags this as a possible emerging triple-extortion pattern, not a confirmed standard practice
⚠️Impact:
300+ confirmed victims across sectors where downtime is especially costly (healthcare, education, legal)
Attackers specifically target backup infrastructure (shadow copy deletion, backup file wipers) to remove recovery options before demanding payment
Abuse of legitimate/whitelisted remote access tools makes detection harder for organizations relying on allowlisting alone
Possible secondary extortion attempts even after ransom payment (per the one documented case — not established as routine Medusa behavior)
💡Recommendations:
Patch CVE-2024-1709 (ScreenConnect) and CVE-2023-48788 (Fortinet EMS) immediately if still exposed
Enforce MFA across webmail, VPN, and critical system access
Segment networks to limit lateral movement via RDP/PsExec
Maintain offline, immutable backups covering full data infrastructure — not just primary systems
Audit which remote access/RMM tools are authorized in your environment and monitor for unauthorized instances of AnyDesk, Splashtop, ConnectWise, etc.
Monitor for LOTL indicators: obfuscated PowerShell (base64/gzip patterns), certutil file transfers, WMI-based remote queries
Disable unused ports and restrict command-line/scripting privileges where operationally feasible
Read the full story HERE