Advisory warns of Medusa ransomware activity 

A joint advisory released March 12 by the FBI, Cybersecurity and Infrastructure Security Agency, and the Multi-State Information Sharing and Analysis Center warns of activity by Medusa ransomware observed as recently as February. Medusa is a ransomware-as-a-service group that was first identified in 2021.  

The group has more than 300 victims from the medical, education, legal, insurance, technology and manufacturing industries, among others. 

“This well-known foreign ransomware group has conducted high impact ransomware attacks against hospitals, resulting in disruption and delay to health care delivery and posing a risk to patient and community safety,” said John Riggi, AHA national advisor for cybersecurity and risk. “They routinely engage in double extortion, where they demand an extortion payment to not publish stolen patient data and a payment for the decryption key to unlock encrypted data and systems. This gang exploits stolen credentials and known vulnerabilities. It is recommended that the actionable threat intelligence contained in the alert be ingested into network defenses. It is also recommended that organizations prioritize patching of known exploited vulnerabilities, segment networks and employ best practices for identity and access management.” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.