Medusa Ransomware

The Medusa ransomware is a ransomware-as-a-service (RaaS) variant used by threat actors to gain access to vulnerable systems and sensitive information, which is then leveraged for extortion tactics. The Cybersecurity and Infrastructure Security Agency (CISA) in partnership with the Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC) has recently released joint Cybersecurity #StopRansomware: Medusa Ransomware to provide awareness of the Medusa ransomware tactics, techniques and procedures (TTP) and indicators of compromise (IoCs).

To mitigate Medusa Ransomware activities, the advisory suggests:

• Ensuring operating systems, software, and firmware are patched and up to date
• Segmenting networks to restrict lateral movement
• Filtering network traffic by preventing unknown or untrusted actors from accessing remote services

Texas RE encourages Responsible Entities to review the CISA Alert for more information about the TTPs and information about the risks associated with the Medusa ransomware.