Joint Advisory Warns of Extensive Medusa Ransomware Operations

A joint CISA–FBI–MS-ISAC advisory warns that the Medusa ransomware operation, now operating as a Ransomware-as-a-Service, has compromised hundreds of organizations across critical infrastructure sectors in the U.S. and worldwide; attackers recruit affiliates and initial-access brokers, exploit vulnerabilities (including CVE-2023-48788), use phishing and RDP brute-force, deploy tools like Mimikatz and PowerShell to move laterally and exfiltrate data, and employ AES-256/RSA encryption plus deletion of backups and shadow copies to maximize operational disruption and pressure victims with double-extortion tactics.