This script propagates MedusaLocker throughout the network by editing the EnableLinkedConnections value within the infected machine’s registry, which then allows the infected machine to detect attached hosts and networks via Internet Control Message Protocol (ICMP) and to detect shared storage via Server Message Block (SMB) Protocol. MedusaLocker ransomware uses a batch file to execute PowerShell script invoke-ReflectivePEInjection.
Actors also frequently use email phishing and spam email campaigns-directly attaching the ransomware to the email-as initial intrusion vectors.
MedusaLocker ransomware actors most often gain access to victim devices through vulnerable Remote Desktop Protocol (RDP) configurations. MedusaLocker ransomware payments appear to be consistently split between the affiliate, who receives 55 to 60 percent of the ransom and the developer, who receives the remainder.ĭownload the PDF version of this report: pdf, 633 kb Typical RaaS models involve the ransomware developer and various affiliates that deploy the ransomware on victim systems. MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed split of ransom payments. The note directs victims to provide ransomware payments to a specific Bitcoin wallet address. The MedusaLocker actors encrypt the victim's data and leave a ransom note with communication instructions in every folder containing an encrypted file. Observed as recently as May 2022, MedusaLocker actors predominantly rely on vulnerabilities in Remote Desktop Protocol (RDP) to access victims’ networks. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN) are releasing this CSA to provide information on MedusaLocker ransomware. Visit to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Note: this joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. Enable and enforce multifactor authentication.Train users to recognize and report phishing attempts.Prioritize remediating known exploited vulnerabilities.Actions to take today to mitigate cyber threats from ransomware:
0 kommentar(er)
