Meduza (MedusaLocker) Ransomware

Meduza, which is a type of ransomware from the MedusaLocker family, was identified during our analysis of malware samples. Its primary function is to encrypt files, and it appends a specific extension (such as ".meduza24") to the filenames while also generating a ransom note named "How_to_back_files.html."

To illustrate, when Meduza encrypts files, it renames them as follows: "1.jpg" becomes "1.jpg.meduza24," "2.png" changes to "2.png.meduza24," and so on.

The ransom note informs the victim that their crucial files have been encrypted using RSA and AES encryption methods. It strongly discourages any attempts to recover these files using third-party software, as this could lead to permanent corruption. Modifying or renaming the encrypted files is also advised against.

According to the ransom note, no software available online can assist in decryption, and the only solution lies with the attackers. They claim to have collected highly confidential and personal data, stored on a private server, which will be deleted upon receiving payment. Failure to pay would result in the data being made public or sold.

The note emphasizes that the attackers are solely motivated by financial gain and have no intention of harming the recipient's reputation or business operations. To demonstrate their ability to decrypt files, they offer to decrypt 2-3 less important files for free upon request.

Contact information for negotiating the ransom and obtaining decryption software is provided through two email addresses (ithelp01@securitymy.name and ithelp01@yousheltered.com). The note also advises creating a new, free email account on protonmail.com to establish contact.

Past a 72-hour deadline, the ransom amount increases if the victim fails to contact the attackers. Additionally, there is a reference to Tor-chat for ongoing communication.

Meduza Ransom Note in Full

The complete text of the Meduza ransom note reads as follows:

YOUR PERSONAL ID:

YOUR COMPANY NETWORK HAS BEEN PENETRATED
All your important files have been encrypted!

Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.

email:
ithelp01@securitymy.name
ithelp01@yousheltered.com
To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Tor-chat to always be in touch:

How Can Ransomware Infect Your Computer?

Ransomware can infect your computer through various methods, and it often relies on social engineering tactics to trick users into initiating the infection. Here are some common ways ransomware can infect your computer:

• Malicious Email Attachments: One of the most common methods is through phishing emails. Attackers send emails that appear legitimate and may contain attachments, such as PDFs or Office documents, with embedded malicious code. When you open the attachment, the ransomware is executed.
• Malicious Links: Phishing emails can also include links to malicious websites. Clicking on these links can lead to drive-by downloads, where the ransomware is automatically downloaded and executed without your knowledge.
• Fake Software Updates: Attackers may create fake software update notifications or pop-ups that mimic legitimate updates for your operating system or software. If you download and install these fake updates, you might unknowingly install ransomware.
• Infected Software: Sometimes, attackers compromise legitimate software installers and inject ransomware into them. When you download and install what appears to be a safe program, you inadvertently install ransomware.
• Malvertising: Malicious advertising, or malvertising, involves cybercriminals placing infected ads on legitimate websites. Clicking on these ads can redirect you to websites that distribute ransomware.
• Remote Desktop Protocol (RDP) Attacks: If your RDP is improperly secured, attackers may exploit vulnerabilities to gain remote access to your computer. Once inside, they can install ransomware.
• Exploiting Vulnerabilities: Ransomware can exploit software vulnerabilities in your operating system or applications. Keeping your software up-to-date with the latest security patches helps protect against this method.
• Social Engineering: Attackers may impersonate trusted entities, like tech support or colleagues, to trick you into downloading and executing files that contain ransomware.