Analysis Summary

A RaaS (Ransomware-as-a-Service) variant dubbed MedusaLocker first surfaced in 2019. The majority of MedusaLocker ransomware threat actors acquire access to victim systems via vulnerable Remote Desktop Protocol (RDP) configurations. The threat actors also utilize email phishing and spam email campaigns as initial intrusion vectors, directly attaching the ransomware to the email. A batch file is used by the MedusaLocker ransomware to run the PowerShell script invoke-ReflectivePEInjection. By editing the EnableLinkedConnections setting in the infected system's registry, this script spreads MedusaLocker over the network. The infected machine then detects attached networks and hosts through Internet Control Message Protocol (ICMP) and shared storage via Server Message Block (SMB) Protocol.

MedusaLocker avoids executable files, most likely to prevent leaving the targeted machine inoperable until the ransom is paid. It employs AES and RSA-2048 encryption and appends extensions such as .encrypted, .bomber, .boroff, .breakingbad, .locker16, .newlock, .nlocker, and .skynet.

MedusaLocker perpetrators insert a ransom note into the folders that contain a file holding the victim's encrypted data. The message explains how to contact the MedusaLocker threat actors, usually by providing victims with one or more email addresses. The magnitude of MedusaLocker ransom demands appears to fluctuate according to the actors' perception of the victim's financial situation or status.

It is important to note that paying the ransom does not guarantee that the decryption key will be provided, and it may also encourage further attacks. Instead, it is recommended to try and recover the data using backup copies or seek the help of a professional cybersecurity firm. To protect against Medusa Locker Ransomware and other types of ransomware, it is important to keep antivirus software and operating systems up to date, avoid opening suspicious email attachments or downloading software from untrusted sources, and regularly back up important data.

Ransom Note: