FBI, CISA, & FinCEN Sound Alarm About MedusaLocker Ransomware
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN) have issued a joint cybersecurity advisory about MedusaLocker ransomware.
The MedusaLocker threat group appears to operate as a ransomware-as-a-service operation, where affiliates are recruited to conduct the attacks for between 55 and 60% of any ransom payments they generate. MedusaLocker was first detected in September 2019 and has been used to attack a broad range of targets in the United States.
Once access to victims’ networks has been gained, a batch file is used to execute a PowerShell script that propagates MedusaLocker throughout the network. This is achieved by editing the EnableLinkedConnections value within the infected machine’s registry, which then allows the infected machine to detect attached hosts and networks via Internet Control Message Protocol (ICMP) and detect shared storage via Server Message Block (SMB) Protocol.
MedusaLocker will terminate security, accounting, and forensic software, restart the machine in safe mode to prevent security software from detecting the ransomware, and then files will be encrypted. All files are encrypted apart from those that are critical to the functionality of the victims’ devices. As is common with ransomware, local backups and shadow copies are deleted, and start-up recovery options are disabled.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A variety of vectors are used to gain initial access to networks, including spam and phishing email campaigns, with some campaigns having the ransomware payload directly attached to emails; however, by far the most common method of attack is exploiting vulnerable Remote Desktop Protocol (RDP) configurations.
Indicators of Compromise (IoCs) have been shared along with IP addresses, Bitcoin wallet addresses, email addresses, and TOR addresses that are known to be used by the group. Several mitigations have been suggested, the most important of which are to prioritize remediating known vulnerabilities, enabling and enforcing multifactor authentication, and providing training to employees to help them recognize and avoid phishing attempts.
