FBI, CISA Warn About International Ransomware Threat Using ‘Double Extortion Model’

The alert asks organizations to patch up their software, operating systems, and firmware to defend against attacks.

A member of an alleged hacking group is seen in a file photo. Nicolas Asfouri/AFP via Getty Images

Multiple U.S. federal agencies have issued a joint advisory warning about Medusa, a ransomware-as-a-service (RaaS) cyber threat that was first identified in June 2021.

RaaS is a business model in which ransomware tools are sold by developers to third parties who then launch attacks on targets.

“As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors,” said the March 12 advisory, published by the Cybersecurity and Infrastructure Security Agency (CISA).

Industries targeted by Medusa include technology, medical, insurance, manufacturing, legal, and education.

The advisory said Medusa actors—developers and affiliates who use the service—deploy a “double extortion model, where victims must pay to decrypt files and prevent further release” of the stolen data.

“The ransom note demands victims make contact within 48 hours via either a Tor browser-based live chat or via Tox, an end-to-end encrypted instant-messaging platform.”

“If the victim does not respond to the ransom note, Medusa actors will reach out to them directly by phone or email,” the agencies said.

The joint advisory was issued by CISA, the FBI, and the Multi-State Information Sharing and Analysis Center to disseminate known tactics, procedures, and other useful information related to Medusa.

Medusa runs a data leak website that reports about their victims and the time left for them to pay the ransom, together with links to crypto wallets.

While the countdown is ongoing, Medusa also advertises the stolen data for sale to anyone who wishes to purchase it. To extend the countdown by a single day, victims typically have to pay $10,000 in cryptocurrencies.

“FBI investigations identified that after paying the ransom, one victim was contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid.” This actor then “requested half of the payment be made again to provide the ‘true decryptor’—potentially indicating a triple extortion scheme,” said the advisory.

To safeguard themselves from Medusa, organizations should mitigate known vulnerabilities in their systems, the agencies advised. This includes patching up firmware, software, and operating systems.

All accounts in the network that have password logins must be obligated to comply with National Institute of Standards and Technology standards.

“In particular, require employees to use long passwords and consider not requiring frequently recurring password changes, as these can weaken security,” the agencies advised.

According to a Feb. 25 report by cybersecurity company Barracuda, Medusa potentially operates from Russia or an allied state, given that the group is active on Russian cybercrime forums, with its members using Russian criminal subculture slang in their conversations.

Most of the group’s victims are from the United States, Canada, France, the United Kingdom, Australia, and Italy.

There is no proof of Medusa being an offshoot or a rebrand of a previous group. Medusa appears to run independently, operating with their own infrastructure, Barracuda said.

The joint advisory is part of the #StopRansomware effort from CISA and the FBI that aims to “publish advisories for network defenders that detail network defense information related to various ransomware variants and threat actors,” according to an October 2023 report.

Under the effort, a joint advisory on the “Ghost” ransomware threat was issued last month. The report said ghost actors, located in China, compromised organizations in more than 70 nations.

Threat actors use publicly available code to exploit “common vulnerabilities and exposures” of targets to gain access to their servers. Their targets include critical infrastructure, government networks, health care, and technology companies.