ReliaQuest analyzed a June 2024 Medusa ransomware incident where encryption occurred across hosts in a customer environment, highlighting gaps in visibility and the adversary’s use of compromised VPN access, NTDS credential dumping, and RDP for movement. The report emphasizes Medusa’s reliance on common TTPs, such as living-off-the-land techniques and PowerShell for credential dumping, and offers practical defenses to mitigate such attacks. #Medusa #ReliaQuest #AnyDesk #NTDS #LSASS
Keypoints
- In June 2024, ReliaQuest detected the Medusa ransomware activity after EDR alerts signaled encryption across hosts in a customer environment.
- Medusa has operated since 2022 as a Ransomware-as-a-Service group targeting technology, education, manufacturing, and healthcare sectors by exploiting unpatched vulnerabilities and hijacking legitimate accounts.
- Investigation found initial access via a compromised VPN account, credential access through NTDS and LSASS dumps, and lateral movement using RDP.
- The report notes Medusa’s use of living-off-the-land techniques, PowerShell for credential dumping, and service installations for persistence.
- Attack surface is exacerbated by a flat network with fragmented domains, visibility gaps, and end-of-life components hindering defense and response efforts.
- Mitigation focuses on robust VPN controls, enhanced endpoint visibility, network segmentation, least privilege, application allow lists, and automated response playbooks.
MITRE Techniques
- [T1133] External Remote Services – Initial access via a compromised VPN account: “the adversary may have gained initial access via the organization’s VPN.”.
- [T1078] Valid Accounts – Use of a compromised VPN account and a customer domain account for access: “domain account belonging to a customer.”.
- [T1021.001] Remote Services – Lateral movement via RDP using a compromised admin account: “lateral movement via type 10 logons (RDP) leveraging a compromised admin account.”.
- [T1046] Network Service Scanning – Discovery actions using Netscan for discovery: “Netscan for discovery actions, which offer features like pinging, port scanning, network share discovery.”.
- [T1003.003] NTDS – NTDS dumps on a domain controller to obtain credential material: “NTDS dump on a domain controller via PowerShell on the same day.”.
- [T1003.001] LSASS – LSASS dumping to harvest in-memory credentials: “LSASS dumping, originated from a VPN-assigned internal IP address.”.
- [T1059.001] PowerShell – Credential dumping and command execution via PowerShell: “powershell.exe ntdsutil.exe ‘ac i ntds’ …”.
- [T1021] Remote Services – AnyDesk installation to maintain access (C2-like behavior): “the threat actor installed AnyDesk on the target server.”.
- [T1562.001] Impair Defenses – Installing a kernel-level driver to bypass EDR and deploy encryptor: “the installation of a vulnerable driver to bypass EDR tools and deploy an encryptor.”.
- [T1486] Data Encrypted for Impact – Encryption of hosts and ransom note delivery: “ransom note ‘!!!READ_ME_MEDUSA!!!.txt’.”.
Indicators of Compromise
- [IP] 178.208.87.250 – anomalous VPN session observed in early April from a Russian IP address used to gain initial access.
- [File] gaze.exe – ransomware encryptor file observed on impacted hosts.
- [File] igJTf.sys – kernel-level driver dropped in WindowsTEMP to bypass security measures.
- [File] C:Program Files (x86)AnyDeskAnyDesk.exe – AnyDesk installation used for persistence/remote access.
- [File] C:ProgramDataJWrapper-Remote AccessJWAppsSharedConfigrestrictedSimpleService.exe – a service-related executable observed during activity.
- [File] PDQInventory-Scanner-1 – PDQInventory-related component installed on multiple hosts; linked to deployment actions.
- [File] !!!READ_ME_MEDUSA!!!.txt – ransom note created on impacted hosts.
Read more: https://www.reliaquest.com/blog/medusa-attack-analysis/