CISA, FBI and MS-ISAC Alert on Medusa Ransomware

CISA, the FBI, and MS-ISAC warned about the Medusa ransomware group which has targeted over 300 victims across critical infrastructure sectors using a double-extortion model; the report details their use of phishing, exploitation of a Fortinet FortiClient EMS vulnerability (CVE-2023-48788), RDP brute-force, credential theft (Mimikatz), lateral movement tools (PsExec, RDP, AnyDesk, ConnectWise), and destructive behaviors like terminating services, deleting Volume Shadow Copies, and encrypting files with AES-256 and RSA to maximize operational disruption and extortion pressure.