FBI warns of ransomware scheme
By: Ashley Ferrer
and Thao Nguyen
USA Today Network
JACKSONVILLE, Florida - Federal cybersecurity agencies and the FBI warned the public against a dangerous ransomware scheme that has affected hundreds of people.
.....
The FBI, Cybersecurity and Infrastructure Security Agency, and ht Multi-State Information Sharing and analysis Center issued a joint cybersecurity advisory last week [03/12/2025] to share information about Medusa ransomware. The advisory is post of CISA's ongoing #StopRansomware initiative, which flags ransomware variants and threat actors, as will as their observed tactics, techniques and procedures.
..... Medusa is a ransomware-as-a-service provider first identified in June 2021, according to the advisory. As of February, [2025] Medusa has affected over 300 victims form multiple critical infrastructure sectors and industries, including medical, education, legal, insurance, technology and manufacturing.
..... Originally, Medusa operated as a closed ransomware variant where all development and associated operations were controlled by the same group of cyber threat actors. It has since shifted toward an affiliate model, where developers and affiliates -called "Medusa actors' - use a double extortionate model "where they encrypt victim data and threaten to publicly release exhilarated data if a ransom is not paid," according to the advisory.
..... The ransom note demands victims make contact within 48 hours through a browser-based live chat or an end-to-end encrypted instant messaging platform, according to the advisory. Victims can also be contacted directly by Medusa actors via phone or email if they do not respond to the ransom note.
.....
Medusa also operates a data leak site, which shows victims alongside countdowns to the release of information, according to the advisor.
..... "Ransom demands are posted on the site, with direct hyperlinks to Medusa-affiliate cryptocurrency wallets," the advisory states.
.....
"At this stage, Medusa concurrently advertises sale of the data to interested paties before the countdown timer ends. Victims can additionally pay $10,000 USD in cryptocurrency to add a day to the countdown timer."
How to protect your organization
..... The FBI, CISA, and MS-ISAC recommended some actions organization should take immediately to protect against Medusa ransomware threats:
* Require virtual private networks to Jump Hosts for remote access.
* Monitor for unauthorized scanning and access attempts.
* Require employees to use long passwords and consider not requiring frequently recurring password changes, which can weaken security.
* Require multi-factor authentication for all services to the extent possible, especially for Gmail and email VPNs, and accounts that access critical systems.
* Keep all operating systems. software, and firmware up to date.
* Implement a recovery plan to maintain and retain multiple copes of sensitive or proprietary data and servers in a physically separate, demented, and secure location (e.g., hard drive, storage device, the cloud).
* segment networks to prevent the spread of ransomware.
* Identify, detect and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool. To aid in detecting the ransomware, implement a toll that logs and reports all network traffic, including lateral movement activity on a network.
Attack on critical infrastructure
..... In recent years, the federal government has doubled down on efforts to toward global cyber crime, which has become increasingly widespread. Federal agencies have issued multiple advisories that warned against the treat of cyberattacks.
.....
Cyber crime is a "significant and growing threat" to national and economic security, according to the State Department. As people become more technologies, the department said more criminals continue to shift to Online schemes.
..... Cyber crimes can range from intellectual property theft to ransomware, potentially costing businesses billions of dollars in losses and threatening critical sectors across the country, according to the State Department.
..... The Surge in malicious Online incident coincides with he rise in Online communication during the COVID-19 pandemic, according to a 2023 cyber threat study. Citing FBI data, the study said cyber crime increased by 400% during the pandemic.
..... Several high-profile cyberattacks have made headlines in recent months. In March, [2025] 12 Chinese citizens were accused of cyber hacking to deal data from the Treasury Department and other organizations worldwide.
..... In January, [2025] USA Today reported that the UnitedHealth data hack affected half of Americans. hackers exposed or stole medical records from about 190 million people in February 2024.
..... In October, [2024] federal prosecutors announced that two Sudanese citizens faced charges of running a guerrilla computer hacking group that sought to "declare cyberwar on the United States" by targeting the FBI, hospitals, Hulu, Netflix, CNN, Microsoft, Reddit and X, among others.
..... Ashley Ferrer is digital producer for the Palm Beach Post. Thao Nguyen is a reporter for USA Today.
..... Contributing: Bart Janse, Krystal Nurse, and Minnah Arshad, USA Today.