A new version of the Medusa malware, which has been available on darknet markets since 2015, has been spotted in the wild. This new variant is based on the Mirai botnet code and is being advertised as a DDoS-as-a-Service platform. It has a ransomware module and a Telnet brute-forcer, as well as the ability to target Linux systems and launch extensive DDoS attacks. The ransomware component of the malware searches for certain file types and encrypts them using AES 256-bit encryption, then appends a .Medusastealer extension to the file name. However, the encryption appears to be broken, making it more of a data wiper than a true ransomware. It also collects basic system information and attempts to download an additional payload. It then uses Zmap to find other devices with Telnet services running on port 23 and attempts to connect to them using a combination of usernames and passwords. The malware also has incomplete support for receiving the FivemBackdoor and Sshlogin commands, indicating that it is still in development.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 07 Feb 2023 18:01:02 +0000