FlagThis - #securityrisk

Federal cybersecurity agencies, including the FBI and CISA, have issued an urgent advisory regarding the escalating threat of Medusa ransomware. Since its emergence in 2021, Medusa has targeted over 300 victims across various critical infrastructure sectors, including medical, education, legal, insurance, technology, and manufacturing. The group's activities have accelerated in recent months, prompting immediate action recommendations for organizations. Medusa operates as a Ransomware-as-a-Service (RaaS) model, now recruiting affiliates from criminal forums to launch attacks, encrypt data, and extort victims worldwide.

Medusa actors leverage common ransomware tactics, including phishing campaigns and exploiting unpatched software vulnerabilities. They employ a double extortion strategy by encrypting victim data and threatening to publicly release it if the ransom is not paid. To mitigate the risk, CISA and the FBI recommend organizations update systems regularly to close known vulnerabilities, implement network segmentation to restrict lateral movement, and enable multi-factor authentication for all services. They also urge organizations to report incidents promptly to aid in tracking and combating the growing threat.


References :

• bsky.app: CISA says the Medusa ransomware operation has impacted over 300 organizations in critical infrastructure sectors in the United States until last month.
• www.bleepingcomputer.com: CISA: Medusa ransomware hit over 300 critical infrastructure orgs
• securityonline.info: FBI, CISA, and MS-ISAC Warn Organizations About Medusa Ransomware Attacks
• DataBreaches.Net: #StopRansomware: Medusa Ransomware
• Industrial Cyber: US exposes Medusa ransomware threat, as over 300 organizations targeted across critical infrastructure sector
• securityaffairs.com: SecurityAffairs article: Medusa ransomware hit over 300 critical infrastructure organizations until February 2025
• www.cybersecuritydive.com: Medusa ransomware slams critical infrastructure organizations
• www.itpro.com: CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
• www.tripwire.com: The Medusa ransomware gang continues to present a major threat to the critical infrastructure sector, according to a newly-released joint advisory from the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC).
• : FBI and CISA Warn of Medusa Ransomware Impacting Critical Infrastructure
• bsky.app: CISA says the Medusa ransomware operation has impacted over 300 organizations in critical infrastructure sectors in the United States until last month.
• The DefendOps Diaries: Explore the impact of Medusa ransomware on critical infrastructure and learn strategies to enhance cybersecurity defenses.
• www.scworld.com: Medusa ransomware, a ransomware-as-a-service group, has increased attacks targeting critical infrastructure, potentially preparing for geopolitical conflicts. Recent attacks indicate a 150% increase in this activity.
• Tenable Blog: Tenable article: Cybersecurity Snapshot: Medusa Ransomware Impacting Critical Infrastructure, CISA Warns, While NIST Selects New Quantum-Resistant Algorithm
• SOC Prime Blog: SOC Prime blog: Medusa Ransomware Attacks Covered in AA25-071A Detection
• be4sec: Medusa Ransomware is Targeting Critical Infrastructure
• be4sec: This advisory summarizes the key activities of prominent ransomware groups in January 2025, highlighting a significant increase in Medusa attacks.
• aboutdfir.com: Medusa ransomware group has been actively targeting critical infrastructure organizations, employing a double extortion tactic.
• www.techradar.com: US government warns Medusa ransomware has hit hundreds of critical infrastructure targets
• cyble.com: The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a well-timed advisory on the Medusa ransomware group last week, as Cyble has detected an acceleration in the group’s activities in recent months.
• Email Security - Blog: Medusa Ransomware: Multi-Industry Threat on the Rise
• techxplore.com: Cybersecurity officials warn against potentially costly Medusa ransomware attacks
• Security | TechRepublic: Medusa Ransomware Strikes 300+ Targets: FBI & CISA Urge Immediate Action to #StopRansomware
• eSecurity Planet: Medusa Ransomware Warning: CISA and FBI Issue Urgent Advisory
• Blue Team Con: CISA and the FBI warn about Medusa ransomware, urging organizations to update security, enable MFA, and report incidents to mitigate the growing threat.
• thecyberexpress.com: Medusa Ransomware Surge: 60 Victims in 3 Months—Are You Next?
• www.zdnet.com: How to guard against a vicious Medusa ransomware attack - before it's too late
• www.cysecurity.news: The Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC), has issued a #StopRansomware advisory, warning organizations about the increasing threat of Medusa ransomware.
• Sam Bent: Cybercriminal Group Medusa Targets Critical Infrastructure Sectors A sophisticated cybercriminal group known as Medusa has been targeting many critical infrastructure sectors in the United States.
• The Hacker News: Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
• www.cybersecuritydive.com: Medusa ransomware using malicious driver as EDR killer

Classification:

• HashTags: #MedusaRansomware #RaaS #Cybersecurity
• Target: Various Sectors
• Attacker: Medusa
• Feature: Ransomware
• Malware: Medusa
• Type: Ransomware
• Severity: Disaster

The Medusa ransomware operation has significantly impacted critical infrastructure sectors, affecting over 300 organizations in the United States by February 2025. According to CISA, these attacks have targeted essential services across various industries, including medical, education, legal, insurance, technology, and manufacturing. This widespread impact highlights the vulnerability of critical infrastructure and the potential for severe disruptions. The healthcare sector has been a primary target, with ransom demands ranging from $100,000 to $15 million, potentially disrupting patient care and compromising sensitive data.

Educational institutions have also been significantly affected, with 21 attacks reported in February 2025 alone. These attacks disrupt academic activities and compromise personal information of students and staff. In response, CISA, in partnership with the FBI and MS-ISAC, released a joint Cybersecurity Advisory providing tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity. The advisory encourages organizations to ensure operating systems and software are up to date, segment networks to restrict lateral movement, and filter network traffic to prevent unauthorized access.


References :

• Industrial Cyber: Recent findings from Symantec indicate a significant rise in Medusa ransomware activity, which is reportedly being operated as...
• securityaffairs.com: Medusa ransomware has claimed nearly 400 victims since January 2023, with attacks increasing by 42% between 2023 and 2024.
• : Symantec found that Medusa has listed almost 400 victims on its data leaks site since early 2023, demanding ransom payments as high as $15m
• Broadcom Software Blogs: Attacks using this ransomware have displayed consistent TTPs and grown steadily since 2023.
• bsky.app: CISA says the Medusa ransomware operation has impacted over 300 organizations in critical infrastructure sectors in the United States until last month.
• The DefendOps Diaries: Medusa Ransomware: A Growing Threat to Critical Infrastructure
• RedPacket Security: CISA: CISA and Partners Release Cybersecurity Advisory on Medusa Ransomware
• gbhackers.com: Medusa Ransomware Hits 300+ Critical Infrastructure Organizations Worldwide
• securityonline.info: FBI, CISA, and MS-ISAC Warn Organizations About Medusa Ransomware Attacks
• www.bleepingcomputer.com: CISA: Medusa ransomware hit over 300 critical infrastructure orgs
• securityaffairs.com: Medusa ransomware hit over 300 critical infrastructure organizations until February 2025
• Industrial Cyber: US exposes Medusa ransomware threat, as over 300 organizations targeted across critical infrastructure sector
• www.itpro.com: CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
• CyberInsider: FBI: Medusa Ransomware Has Breached 300 Critical Infrastructure Organizations
• www.tripwire.com: The Medusa ransomware gang continues to present a major threat to the critical infrastructure sector, according to a newly-released - with at least one organisation hit with a "triple-extortion" threat. Read more in my article on the Tripwire State of Security blog.
• Resources-2: On March 12, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a joint advisory on Medusa ransomware [1]. Medusa ransomware emerged as Ransomware-as-a-Service in June 2021 and gained infamy by compromising over 300 victims from critical infrastructure sectors, including healthcare, insurance, technology, manufacturing, legal, and technology.
• : CISA, FBI Warn of Medusa Ransomware Impacting Critical Infrastructure
• www.cybersecuritydive.com: The ransomware-as-a-service gang tallied more than 300 victims in industries such as healthcare, manufacturing and technology.
• The Register - Security: Medusa ransomware affiliate tried triple extortion scam – up from the usual double demand
• DataBreaches.Net: #StopRansomware: Medusa Ransomware
• hackread.com: FBI and CISA Urge Enabling 2FA to Counter Medusa Ransomware
• Talkback Resources: #StopRansomware: Medusa Ransomware | CISA [net] [mal]
• Tenable Blog: Cybersecurity Snapshot: Medusa Ransomware Impacting Critical Infrastructure, CISA Warns, While NIST Selects New Quantum-Resistant Algorithm
• SOC Prime Blog: Medusa Ransomware Detection: The FBI, CISA & Partners Warn of Increasing Attacks by Ransomware Developers and Affiliates Against Critical Infrastructure
• www.itpro.com: CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted

Classification:

• HashTags: #Ransomware #Medusa #CriticalInfrastructure
• Company: CISA
• Target: Critical Infrastructure Organizations
• Attacker: Medusa
• Feature: Ransomware-as-a-Service
• Malware: Medusa
• Type: Ransomware
• Severity: Major

Researchers at WatchTowr Labs have uncovered a significant security vulnerability related to abandoned Amazon Web Services (AWS) S3 buckets. These buckets, previously used by various software projects, governments, Fortune 500 companies, and even cybersecurity firms, are now posing a serious threat to the global software supply chain. The study revealed that approximately 150 S3 buckets, after being abandoned, could be re-registered with the same AWS account name. This would allow malicious actors to inject malicious code into software update mechanisms or deployment code, potentially compromising systems and sensitive networks.

WatchTowr researchers, through their analysis, demonstrated the potential for attackers to exploit these abandoned S3 buckets. They found that these buckets were still receiving millions of HTTP requests, including requests for software updates, making them prime targets for supply chain attacks. CEO Benjamin Harris emphasized the inherent issue with the world's approach to infrastructure abandonment and how easy it is to insert malicious code. To mitigate this, AWS has blocked the specific buckets identified by WatchTowr from being re-created and noted having unveiled a bucket ownership condition functionality curbing inadvertent bucket name reuse.


References :

• labs.watchtowr.com: Researchers at WatchTowr Labs have uncovered a critical security vulnerability in abandoned Amazon Web Services (AWS) S3 buckets that could enable attackers to hijack the global software supply chain.
• therecord.media: Researchers warned of malicious actors taking over abandoned AWS S3 buckets.
• www.scworld.com: Extensive software supply chain compromise possible with deserted AWS S3 buckets.

Classification:

• HashTags: #AWS #S3 #SecurityRisk
• Company: Amazon
• Target: AWS S3 Buckets
• Product: AWS S3
• Feature: Abandoned S3 Buckets
• Type: Vulnerability
• Severity: Major