Full Report
CISA and FBI warn of Medusa ransomware impacting over 300 victims across critical infrastructure sectors with double extortion tactics
Analysis Summary
# Incident Report: Medusa Ransomware Campaign Targeting Critical Infrastructure
## Executive Summary
A joint advisory from CISA, FBI, and MS-ISAC warned of widespread compromise by the Medusa Ransomware-as-a-Service (RaaS) operation, impacting over 300 organizations across critical infrastructure sectors like healthcare, education, and manufacturing. Attackers utilized phishing and exploitation of high-profile vulnerabilities (ScreenConnect, Fortinet EMS) for initial access, employing a double extortion model involving data encryption and exfiltration threats. Response efforts are focused on remediation guidance provided by government agencies.
## Incident Details
- Discovery Date: Unknown (Advisory issued March 13, 2025, indicating prior widespread impact)
- Incident Date: Ongoing since first identification (Medusa RaaS first identified June 2021)
- Affected Organization: Over 300 victims, including organizations in healthcare, education, legal, insurance, technology, and manufacturing sectors.
- Sector: Critical Infrastructure (Healthcare, Education, Legal, Insurance, Technology, Manufacturing)
- Geography: Not explicitly stated, but involving US federal agencies suggests a nationwide or international scope.
## Timeline of Events
### Initial Access
- Date/Time: Ongoing since June 2021/Recent Exploitation
- Vector: Phishing campaigns and exploitation of unpatched software vulnerabilities.
- Details: Specific vulnerabilities exploited include the ScreenConnect authentication bypass (**CVE-2024-1709**) and Fortinet EMS SQL injection flaw (**CVE-2023-48788**).
### Lateral Movement
- Details: Attackers leveraged legitimate administrative tools, specifically **PowerShell** and **Windows Management Instrumentation (WMI)**, to move internally within the compromised network.
### Data Exfiltration/Impact
- Impact: Data encryption (Ransomware deployment) combined with **data exfiltration** via a double extortion model. Attackers threatened public release of exfiltrated data if the ransom demand was unpaid.
### Detection & Response
- Detection: Public warning issued via joint advisory from CISA, FBI, and MS-ISAC.
- Response Actions: Agencies provided guidance and reporting mechanisms to affected entities (implied by the advisory nature).
## Attack Methodology
- Initial Access: Phishing campaigns, Exploitation of **CVE-2024-1709** (ScreenConnect), Exploitation of **CVE-2023-48788** (Fortinet EMS SQL injection).
- Persistence: Not explicitly detailed, but typically implied by RaaS operations.
- Privilege Escalation: Not explicitly detailed.
- Defense Evasion: Not explicitly detailed.
- Credential Access: Not explicitly detailed.
- Discovery: Use of built-in tools like **PowerShell** and **WMI** suggests system and network enumeration.
- Lateral Movement: **PowerShell** and **WMI**.
- Collection: Data theft prior to encryption (implied by double extortion).
- Exfiltration: Data exfiltration prior to encryption/payment demand.
- Impact: Data availability loss via encryption and financial extortion pressure.
## Impact Assessment
- Financial: Ransom demands (implied, as this is a RaaS operation). Costs related to remediation and business disruption.
- Data Breach: Sensitive data exfiltrated, details of volume/type unspecified, but significant enough to support double extortion.
- Operational: Significant disruption across multiple critical infrastructure sectors (Healthcare, Manufacturing are particularly sensitive).
- Reputational: High, given the scale (300+ victims) and involvement of critical infrastructure entities.
## Indicators of Compromise
*Note: As this is an advisory summary, specific IOCs were not provided in the text, but the TTPs point toward: *
- Network indicators: C2 communication associated with Medusa RaaS payloads (Defanged).
- File indicators: Medusa ransomware executables/scripts.
- Behavioral indicators: Execution of PowerShell/WMI for system discovery/management by unauthorized initial access accounts.
## Response Actions
- Containment: Not explicitly detailed, but standard response would include isolating affected network segments and disabling exploited services/vulnerabilities.
- Eradication: Not explicitly detailed, but would involve removing RaaS components and restoring systems from clean backups.
- Recovery Actions: Restoring encrypted data and ensuring all persistence mechanisms are removed.
## Lessons Learned
- Unpatched critical software (ScreenConnect, Fortinet EMS) remains a primary entry point for sophisticated ransomware groups.
- Critical infrastructure sectors are primary targets for double extortion ransomware operations like Medusa.
- Reliance on native administration tools (**PowerShell, WMI**) can be abused for rapid internal movement.
## Recommendations
- Immediately patch all instances of affected software, specifically ScreenConnect and Fortinet EMS, addressing **CVE-2024-1709** and **CVE-2023-48788**.
- Enhance monitoring for anomalous use of administrative tools like PowerShell and WMI, especially when executed by unusual accounts.
- Implement robust email filtering and user training to mitigate phishing campaign risks.
- Ensure comprehensive, segmented backups are maintained and tested regularly to mitigate the impact of encryption.