As of May 2022, MedusaLocker has been observed predominantly exploiting vulnerable Remote Desktop Protocol (RDP) configurations to access victims' networks, according to a new joint Cybersecurity Advisory (CSA) from the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and other law enforcement agencies.
The advisory is part of CISA's #StopRansomware collection of resources about ransomware. "MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed split of ransom payments," the CSA notes.
Technical Detail Summary:
This ransomware strain uses a batch file to execute a PowerShell script which propagates MedusaLocker throughout the network by editing the EnableLinkedConnections value within the infected machine’s registry, which then allows the infected machine to detect attached hosts and networks via Internet Control Message Protocol (ICMP) and to detect shared storage via Server Message Block (SMB) Protocol.
Note that this new Cybersecurity Advisory has a top-right Action Box with suggestions you need to take ASAP to mitigate this threat. Their second bullet is: Train users to recognize and report phishing attempts.
Grab your free Phish Alert Button and train your users as soon as you can. Here is a link to the full Cybersecurity Advisory which has a PDF, full Indicators of Compromise (IoC) and suggested mitigations
https://www.cisa.gov/uscert/ncas/alerts/aa22-181a
Here's how it works:
