The FBI has issued a critical warning for users of Gmail, Outlook, and VPN services. It has urged users to enable two-factor authentication (2FA) immediately to keep their accounts safe. This comes as the Medusa ransomware gang continues to target businesses and individuals with highly sophisticated attacks. The latest FBI and CISA cybersecurity advisory highlights the growing threat of ransomware-as-a-service (RaaS) and provides essential mitigation steps to protect against potential breaches.
Medusa is one of the most dangerous ransomware groups that has impacted at least 300 critical infrastructure organizations since June 2021. The attackers use a combination of social engineering and software vulnerabilities to infiltrate systems, often moving laterally within networks to escalate privileges and exfiltrate sensitive data before deploying ransomware.
According to the FBI, Medusa employs advanced techniques such as:
- Base64-encrypted PowerShell commands to evade detection.
- Tools like Mimikatz to extract login credentials from system memory.
- Remote access software like AnyDesk and ConnectWise to maintain persistent access.
- PsExec and RDP for spreading ransomware across the network.
- Killing over 200 Windows processes, including security software, to maximize impact.
FBI’s Recommended Security Measures
To mitigate the risk of ransomware attacks, the FBI advises taking the following immediate actions:
- Enable Two-Factor Authentication (2FA) – Apply 2FA for all accounts, especially for Gmail, Outlook, VPNs, and other services with access to critical systems.
- Use Strong, Long Passwords – Avoid frequent password resets, as they can lead to weaker security practices.
- Maintain Multiple Data Backups – Store sensitive data in physically separate, secure locations.
- Update Systems and Software – Patch known vulnerabilities in internet-facing systems.
- Monitor Network Activity – Use network monitoring tools to detect unusual behavior and prevent unauthorized access.
- Filter Network Traffic – Block access from unknown or untrusted origins.
- Restrict Administrative Privileges – Follow the principle of least privilege to limit access.
- Disable Unused Ports and Scripts – Reduce the attack surface by disabling unnecessary system features.
While the FBI’s security recommendations focus on technical defenses, some cybersecurity experts argue that they overlook a major attack vector—social engineering. Most attracts involve social engineering. So, users should be aware and alert to avoid social engineering risks.
