Servifruit ... has fallen victim to a ransomware attack conducted by the group medusalocker.
MedusaLocker
MedusaLocker is a Windows ransomware family first identified in September 2019 that targets organizations worldwide.
MedusaLocker
Family profile
MedusaLocker is a Windows ransomware family first identified in September 2019 that targets organizations worldwide. It is deployed through affiliate-based ransomware operations, with attackers commonly obtaining access through vulnerable Remote Desktop Protocol configurations and through phishing or spam emails, including messages carrying ransomware payloads. MedusaLocker is unrelated to the similarly named Medusa ransomware operation and Medusa Android banking trojan.
The malware encrypts files on local disks, mapped network drives, and accessible SMB shares using AES, including AES-256 in documented variants, and protects the encryption keys with RSA-2048. It performs ICMP network discovery, identifies shared storage through SMB, and modifies Windows networking behavior to reconnect mapped drives and expand encryption coverage. It leaves ransom instructions in affected directories and periodically repeats encryption scans while excluding files necessary for system operation and files already encrypted.
MedusaLocker establishes persistence through scheduled tasks and a copy of its executable in the user's roaming profile. Documented execution chains use PowerShell-based reflective PE injection, and the family has used an ICMLuaUtil COM-based UAC bypass for privilege escalation. It terminates security, database, accounting, and other application processes, and can reboot systems into safe mode to evade security controls. To inhibit recovery, it deletes shadow copies and backups and disables Windows recovery features. Variants largely retain these core behaviors while changing encrypted-file extensions and ransom-note presentation.
Capabilities
- Defense Evasion
- Extortion
- Lateral Movement
- Persistence
- Privilege Escalation
- Process Injection
- Reconnaissance
- Scanning
Samples
Recent samples
1 sandbox sample in the Derp library, newest 1 shown
Reported operators
Threat actors
2 named in public reporting"...web server exploitation campaigns in 2020 that primarily delivered MedusaLocker ransomware."
Exploited software
Vulnerabilities linked to MedusaLocker
2 CVEsMITRE ATT&CK
MedusaLocker in ATT&CK
46 distinct techniquesTechniques
46 techniques T1213 Data from Information Repositories T1486 Data Encrypted for Impact T1537 Transfer Data to Cloud Account T1053 Scheduled Task/Job T1569 System Services T1112 Modify Registry T1490 Inhibit System Recovery T1489 Service Stop T1135 Network Share Discovery T1685 Disable or Modify Tools T1218 System Binary Proxy Execution T1566 Phishing T1018 Remote System Discovery T1105 Ingress Tool Transfer T1021.002 SMB/Windows Admin Shares T1070 Indicator Removal T1046 Network Service Discovery T1548.002 Bypass User Account Control T1497 Virtualization/Sandbox Evasion T1059.001 PowerShell T1688 Safe Mode Boot T1133 External Remote Services T1203 Exploitation for Client Execution T1041 Exfiltration Over C2 Channel T1070.004 File Deletion T1057 Process Discovery T1570 Lateral Tool Transfer T1204 User Execution T1053.005 Scheduled Task T1497.001 System Checks T1190 Exploit Public-Facing Application T1547.001 Registry Run Keys / Startup Folder T1083 File and Directory Discovery T1078 Valid Accounts T1082 System Information Discovery T1110 Brute Force T1059.003 Windows Command Shell T1622 Debugger Evasion T1074 Data Staged T1567 Exfiltration Over Web Service T1021.001 Remote Desktop Protocol T1036 Masquerading T1003 OS Credential Dumping T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information