Medusa Ransomware: From data leaks to multiple extortions

ransomware threat , with perpetrators stepping up their activities after a data leak site was exposed on the dark web.

The group offers options to victims when data is published, such as extending the time, deleting data, or obtaining all data, at a cost that depends on the organization.

Read also: Toyota: Medusa ransomware gang threatens to leak data

Medusa is a ransomware family that affects various industry sectors, including technology, education, manufacturing, healthcare, and retail. It has affected up to 74 organizations, primarily in the United States, United Kingdom, France, Italy, Spain, and India.

Attacks begin by exploiting assets and applications with known vulnerabilities, as well as by compromising legitimate accounts. Men-in-the-middle are used to gain initial access to networks. In addition, there is a reliance on off-world techniques and the use of kernel drivers.

Victims are exposed to a website , where options are offered and a ransom is demanded. The threat even extends to physical violence, going beyond the level of public outcry. As ransomware attacks remain a growing threat, hackers are becoming increasingly sophisticated.

See also: Medusa ransomware hits Philippine Health Insurance Corporation

According to research by Sophos, ransomware is evolving and becoming more professional. This ransomware gang uses multimedia and the public Telegram channel to exchange information. Arctic Wolf Labs uncovered cases where victims of Akira and Royal were victimized by malicious third parties posing as security researchers.

The Finnish National Security warns of an increase in Akira ransomware incidents exploiting security flaws in Cisco VPN devices.

Source: thehackernews.com