Medusa Ransomware Affiliates Target Healthcare Organizations
The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency have issued a warning to healthcare organizations about the threat of Medusa ransomware affiliates exploiting unpatched software and common vulnerabilities and exposures.
Why Healthcare Organizations Should Pay Attention
In a joint advisory with the Multi-State Information Sharing and Analysis Center, the FBI and CISA outlined the tactics, techniques, and procedures used by Medusa ransomware affiliates. This variant has already affected over 300 victims in critical infrastructure sectors, including a state health insurer, since 2021.
Medusa ransomware developers recruit cybercriminals in forums and marketplaces to gain initial access to potential victims. Affiliates use legitimate tools like Advanced IP Scanner and SoftPerfect Network Scanner to evade detection and establish a presence on networks.
Victims are demanded to contact the ransomware operators within 48 hours through a Tor browser-based live chat or the encrypted instant-messaging platform Tox. Failure to comply may result in direct outreach via phone or email.
To mitigate the risk of Medusa ransomware attacks, organizations should ensure their operating systems, software, and firmware are regularly patched and up to date. Network segmentation and traffic filtering can also limit lateral movement and unauthorized access to internal systems.
The Growing Threat of Ransomware Attacks
Medusa ransomware utilizes phishing campaigns and exploits vulnerabilities in software like ConnectWise ScreenConnect, as seen in the recent Change Healthcare cyberattack. Rural hospitals, in particular, are at risk due to limited resources and cybersecurity measures, making them prime targets for cyber exploitation.
Expert Insights
In a statement, the FBI, CISA, and MS-ISAC highlighted the evolution of Medusa ransomware from a closed variant to an affiliate model. While affiliates play a role in the distribution of the ransomware, key operations such as negotiation remain centralized with the developers.
Andrea Fox, Senior Editor of Healthcare IT News, can be reached at afox@himss.org. Healthcare IT News is a publication of HIMSS Media.
