The server is hosted on a network routed via SELECTEL in Russia (AS49505) and runs Ubuntu Linux with OpenSSH 8.9p1. The server exposes three services: SSH on port 22, HTTP on port 80, and an additional HTTP service on port 3000. Most notably, the standard SSH port remained open with password authentication enabled rather than key-based authentication, and the HTTP service on port 3000 directly exposed the Medusa Locker Group’s victim negotiation portal. This exposure represents a rare instance where cybercriminal operations protected by the anonymity of the Tor network have been compromised through technical vulnerabilities rather than operational security mistakes. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Their typical modus operandi includes operating a Tor-based leak site where they publish sensitive data stolen from victims who refuse to pay ransom demands, creating a double-extortion pressure tactic that has proven effective against many organizations. Covsec researchers identified a critical vulnerability in Medusa’s ransomware blog platform that allowed them to bypass the protections afforded by the Tor network. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The Medusa Ransomware Group, which has operated with relative anonymity through Tor hidden services, has had its cover blown through a sophisticated exploitation of vulnerabilities in their own infrastructure. The exploitation process leveraged a vulnerability in the blog platform used by the Medusa group to showcase their victims. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The exposed server demonstrates poor security configurations that contributed to the successful deanonymization. Researchers have uncovered the true identity of servers hosting one of the most notorious ransomware operations active today. This simple command, when executed on the compromised server, returned the actual external IP address rather than the onion routing address.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 19:00:09 +0000