A ransomware operator that’s been protecting a low profile for the previous couple of years has struck gold after a string of profitable and high-profile ransomware assaults on company victims.

Per BleepingComputer (opens in new tab), the risk group often known as Medusa dates again to June 2021, but it surely has solely simply entered the highlight after its current assault on the Minneapolis Public Faculties (MPS) district. 

Numerous sources declare the group has demanded $1 million in trade for the decryption key, with negotiations nonetheless ongoing. Now, MPS has till March 17 to pay up, or face having its delicate information leaked to the general public through a devoted weblog.

Id disaster

If the group plans on being extra lively, although, it would need to contemplate rebranding. There are a number of different risk actors going by the title Medusa, which resulted in complicated media reviews, BleepingComputer states. 

Such examples embrace a wholly completely different ransomware group known as MedusaLocker, a chunk of Android malware known as Medusa, and a Medusa botnet primarily based on the notorious Mirai. 

The MedusaLocker ransomware group is regarded as two years older than Medusa, as the primary reviews of its exercise began showing in 2019. It’s a Ransomware-as-a-Service group, with a number of associates utilizing the service to focus on company victims. 

The 2 teams additionally differ within the ransom notes they go away. Whereas MedusaLocker leaves a .HTML file named How_to_back_files, Medusa leaves a .TXT file titled !!!READ_ME_MEDUSA!!!.

What’s extra, Medusa encrypts information with the .MEDUSA file extension, whereas MedusaLocker makes use of all kinds of extensions.

• Here is our checklist of one of the best firewalls (opens in new tab) proper now

Through: BleepingComputer (opens in new tab)