skip to Main Content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038

    This ransomware strain uses RDP flaws to hack into your network

    As of May 2022, MedusaLocker has been observed predominantly exploiting vulnerable Remote Desktop Protocol (RDP) configurations to access victims’ networks, according to a new joint Cybersecurity Advisory (CSA) from the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and other law enforcement agencies.

    The advisory is part of CISA’s #StopRansomware collection of resources about ransomware. “MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed split of ransom payments,” the CSA notes.

    Technical Detail Summary:

    This ransomware strain uses a batch file to execute a PowerShell script which propagates MedusaLocker throughout the network by editing the EnableLinkedConnections value within the infected machine’s registry, which then allows the infected machine to detect attached hosts and networks via Internet Control Message Protocol (ICMP) and to detect shared storage via Server Message Block (SMB) Protocol.

    Note that this new Cybersecurity Advisory has a top-right Action Box with suggestions you need to take ASAP to mitigate this threat. Their second bullet is: Train users to recognize and report phishing attempts.

    Grab your free Phish Alert Button and train your users as soon as you can. Here is a link to the full Cybersecurity Advisory which has a PDF, full Indicators of Compromise (IoC) and suggested mitigations

    Free Phish Alert Button

    Do your users know what to do when they receive a phishing email? KnowBe4’s Phish Alert Button gives your users a safe way to forward email threats to the security team for analysis and deletes the email from the user’s inbox to prevent future exposure. All with just one click! Phish Alert benefits: 

    Here’s how it works:

    • Reinforces your organization’s security culture
    • Users can report suspicious emails with just one click
    • Incident Response gets early phishing alerts from users, creating a network of “sensors”
    • Email is deleted from the user’s inbox to prevent future exposure
    • Easy deployment via MSI file for Outlook, G Suite deployment for Gmail (Chrome) and manifest install for Microsoft 365

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:


    Sign Up to the TIO Intel Alerts!

    Back To Top