{"id":47354,"date":"2022-07-01T09:39:29","date_gmt":"2022-07-01T09:39:29","guid":{"rendered":"http:\/\/d70c8d2e-c7f0-4400-b9de-4cd44100b7c9"},"modified":"2022-07-01T09:39:29","modified_gmt":"2022-07-01T09:39:29","slug":"fbi-and-cisa-warn-this-ransomware-is-using-rdp-flaws-to-break-into-networks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fbi-and-cisa-warn-this-ransomware-is-using-rdp-flaws-to-break-into-networks\/","title":{"rendered":"FBI and CISA warn: This ransomware is using RDP flaws to break into networks"},"content":{"rendered":"
\n
\n
\"shutterstock-1173443506.jpg\"<\/picture><\/div>\n

<\/div>\n

Image: Shutterstock \/ Marjan Apostolovic<\/span><\/figcaption><\/figure>\n

Several US law enforcement agencies have shone a spotlight on MedusaLocker, one ransomware gang that got busy in the pandemic by hitting healthcare organizations. <\/p>\n

MedusaLocker emerged in 2019 and has been a problem ever since, ramping up activity during the early stages of the pandemic to maximize profits. <\/p>\n

\n

Special Feature <\/h3>\n<\/p><\/div>\n

While Medusa is today not as prolific as Conti and Lockbit<\/a> RaaS networks, MedusaLocker caused its fair share of trouble, being one of several threats that led to Microsoft’s warning to healthcare operators to patch VPN endpoints and configure Remote Desktop Protocol (RDP) securely<\/a>. <\/p>\n

SEE: <\/strong>Ransomware attacks: This is the data that cyber criminals really want to steal<\/strong><\/a><\/p>\n

In the first quarter of 2020, MedusaLocker was one of the top ransomware payloads along with RobbinHood, Maze, PonyFinal, Valet loader, REvil, RagnarLocker, and LockBit, according to Microsoft<\/a>.  <\/p>\n

As of May 2022, Medusa has been observed predominantly exploiting vulnerable RDP configurations to access victims’ networks, according to a new joint Cybersecurity Advisory (CSA)<\/a> from the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN). <\/p>\n

The advisory is part of CISA’s #StopRansomware collection of resources about ransomware<\/a>. <\/p>\n

“MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed split of ransom payments,” the CSA notes. <\/p>\n

RaaS models involve the combined efforts of ransomware developer and various affiliates, such as access brokers that gain initial access and other actors<\/a> that deploy the ransomware on victim systems. <\/p>\n

“MedusaLocker ransomware payments appear to be consistently split between the affiliate, who receives 55 to 60 percent of the ransom; and the developer, who receives the remainder,” the CSA notes. <\/p>\n

At a technical level, after MedusaLocker actors have gained initial access, MedusaLocker deploys a PowerShell script to propagate the ransomware throughout the network by editing the machine’s registry to detect attached hosts and networks, and using the SMB file-sharing protocol to detect attached storage. <\/p>\n

MedusaLocker attackers place a ransom note into every folder containing a file with the victim’s encrypted data, according to the CSA.  <\/p>\n

MedusaLocker’s key actions after spreading across a network include: <\/p>\n