Cyritex Security Lab | 6 variants of MedusaLocker ransomware have been added to the breach and attack simulation library!

Since May 2022, the MedusaLocker ransomware group has continuously released new variants. To date, SecuritySentry has captured 6 variants, which have been incorporated into the SecuritySentry simulated attack library, continuously enhancing SecuritySentry's ransomware defense assessment services.

▌Introduction to MedusaLocker

Attackers using MedusaLocker ransomware primarily rely on vulnerabilities in the Remote Desktop Protocol (RDP) to gain access to victims' networks. After successfully encrypting the victim's data, MedusaLocker attackers leave a ransom note with communication instructions in every folder containing encrypted files. Attackers also frequently use email phishing and spam campaigns—attaching ransomware directly to emails—as the initial intrusion vector. MedusaLocker ransomware uses a batch file to execute a PowerShell script calling -ReflectivePEInjection. This script spreads MedusaLocker throughout the network by editing the EnableLinkedConnections value in the infected machine's registry, which then allows the infected machine to detect connected hosts and networks via the Internet Control Message Protocol (ICMP) and shared storage protocols via Server Message Block (SMB).

▌Attack Simulation Library Update

You can now select sample downloads and ransomware execution simulations for the 6 variants of MedusaLocker on our platform to test the detection and defense capabilities of your network security detection and defense measures, as well as endpoint/host defense measures against these 6 variants. In particular, you can realistically achieve ransomware execution through SecuritySentry's protected sandbox to determine whether your current endpoint/host defense measures can defend against its attack at the very last second, without worrying about the various impacts brought by its destructiveness if it fails to defend. SecuritySentry's protected sandbox will ensure its security and cause no impact.