CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs
CISA says the Medusa ransomware operation has breached more than 500 U.S. critical infrastructure organizations since 2021, up from more than 300 reported last year. The group has targeted healthcare, government, defense, manufacturing, IT and financial organizations, evolving into a ransomware-as-a-service operation that recruits initial-access brokers and uses stolen data to pressure victims…
The Cybersecurity and Infrastructure Security Agency (CISA) has reported that the Medusa ransomware operation has targeted over 500 critical infrastructure organizations in the United States since 2021, a significant increase from the 300+ organizations reported last year. This ransomware group has infiltrated various sectors, including healthcare, government, defense, manufacturing, IT, and financial organizations.
According to BleepingComputer, the Medusa operation has evolved into a ransomware-as-a-service model, where they recruit initial-access brokers (IABs) from cybercriminal forums and marketplaces to gain entry to potential victims. These affiliates are offered payments ranging from $100 USD to $1 million USD, with the option to work exclusively for Medusa.
The three federal agencies have advised network defenders to secure their networks against Medusa's attacks by fixing security vulnerabilities that could be exploited on operating systems, software, and firmware. Additionally, security teams are recommended to segment their networks to prevent lateral movement after a compromise and to block access from untrusted sources to remote services on internal systems.
Written by urgent.news from Slashdot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
