🚨 LIC INDIA LISTED BY MEDUSALOCKER: WHAT ORGANISATIONS SHOULD LEARN FROM THE RANSOMWARE THREAT

MedusaLocker is a long-running ransomware family that emerged in 2019 and has been associated with attacks against organisations across multiple sectors.

It has historically operated through a Ransomware-as-a-Service (RaaS) model, meaning different actors/affiliates may participate in gaining access and deploying ransomware.

This creates an important defensive problem:

The organisation may not be attacked by a single predictable “hacker.”

The attack ecosystem can involve:

Initial Access Broker → compromised credentials/access → attacker → lateral movement → ransomware deployment

Consequently, defending against ransomware requires controlling the entire attack surface, not simply detecting the ransomware executable.

MedusaLocker operators have been observed using:

Vulnerable Remote Desktop Protocol (RDP)

Compromised/valid credentials

Brute-force attacks against exposed remote services

Phishing/malspam

Vulnerable internet-facing infrastructure

CISA and FBI guidance specifically identifies vulnerable RDP configurations as a major historical MedusaLocker access vector.

↓

Credential Abuse / Remote Access

↓

Internal Discovery

↓

Privilege Escalation

↓

Lateral Movement

↓

Security-Control Evasion

↓

Data Discovery / Collection

↓

Potential Data Exfiltration

↓

Backup & Recovery Disruption

↓

Ransomware Deployment

↓

File Encryption

↓

Ransom Demand

This attack chain is particularly dangerous because ransomware deployment is often the final stage, not the beginning of the attack.

By the time the encryption screen appears, the attacker may already have spent considerable time inside the environment.

MedusaLocker has historically exploited exposed or vulnerable RDP services.

MITRE ATT&CK:

T1133 – External Remote Services

Security teams should therefore monitor:

Internet-facing RDP

Repeated failed authentication

Successful login after multiple failures

Login from unusual geographic locations

New source IP addresses

Unusual administrator RDP sessions

RDP access outside normal working hours

CISA specifically recommends securing remote services and prioritising remediation of known exploited vulnerabilities.

Attackers may use compromised credentials rather than deploying obviously malicious malware during the early stages.

MITRE ATT&CK

T1078 – Valid Accounts

This is one of the most dangerous aspects of modern ransomware.

The login may appear legitimate.

The problem is:

The person using the credentials is not legitimate.

Security teams should correlate:

Username

Source IP

Device

Login location

Login time

Authentication method

MFA events

VPN/RDP activity

Privilege level

A successful login from an unusual device followed by administrative activity should generate a high-priority alert.

MedusaLocker research has documented the use of scripting and Windows command-line capabilities.

Relevant MITRE ATT&CK techniques include:

T1059.001 — PowerShell

T1059.003 — Windows Command Shell

Attackers may use legitimate Windows tools to:

Execute commands

Download files

Modify configuration

Stop services

Remove recovery mechanisms

Deploy ransomware

This is why traditional antivirus-only approaches can be insufficient.

The attacker may initially appear to be using legitimate administrative tools.

After gaining access to one endpoint, attackers attempt to expand their control.

Documented MedusaLocker activity has included remote services and Windows administrative mechanisms such as:

RDP

SMB

PsExec

WMI

Relevant MITRE ATT&CK techniques include:

T1021 – Remote Services

T1047 – Windows Management Instrumentation

The objective is simple:

Compromise enough systems so that the organisation cannot easily isolate or recover.

This is where network segmentation becomes critical.

MedusaLocker has historically attempted to interfere with security and recovery mechanisms.

Research has documented behaviours such as:

Stopping security-related services

Terminating processes

Modifying system configuration

Attempting to disable recovery mechanisms

Restarting systems into Safe Mode

Cybereason documented MedusaLocker behaviour involving Safe Mode execution to reduce the effectiveness of security tools that may not operate during that startup state.

This creates a critical detection opportunity.

SOC teams should alert on:

Unexpected service termination

Security software being stopped

Defender/EDR configuration changes

Unusual Safe Mode boot activity

Registry modifications

Sudden administrative changes

One of the most important ransomware objectives is to prevent recovery.

MedusaLocker research documents attempts to remove Windows recovery mechanisms, including Volume Shadow Copies.

Relevant MITRE ATT&CK:

T1490 – Inhibit System Recovery

Potential indicators include suspicious execution of:

vssadmin.exe

wmic.exe

wbadmin.exe

bcdedit.exe

For example, security teams should investigate unexpected commands that delete shadow copies or modify boot recovery settings.

Why?

Because:

If attackers can destroy both production data and recovery mechanisms, the organisation loses its strongest bargaining position.

MedusaLocker uses a hybrid encryption approach.

Research has documented:

AES-256 for file encryption

combined with

RSA-2048 for protecting encryption keys.

The result is that recovering encrypted files without the appropriate recovery mechanism can become extremely difficult.

MedusaLocker has also been documented as targeting files across local and network-accessible locations, increasing the potential blast radius.

Modern ransomware incidents cannot be evaluated only by asking:

“Were files encrypted?”

The second question must be:

“Was data accessed or exfiltrated before encryption?”

The current Licindia intelligence reporting includes the claim of nine extracted emails, but this does not establish the full scope of the incident or prove what those emails contained.

If an attacker accessed sensitive corporate mailboxes, potential risks could include:

Internal communications

Customer correspondence

Financial information

Employee information

Documents exchanged through email

Credentials or password-reset information

Vendor information

Internal system information

Therefore, organisations should treat email compromise as a potential data-loss event, not merely an account-security problem.

If a ransomware intrusion were confirmed, the impact could fall into several categories.

Confidentiality

Unauthorized access to sensitive information.

Integrity

Potential manipulation or deletion of files and systems.

Availability

Encryption can make critical applications and documents unavailable.

Privacy

Potential exposure of personal or customer information.

Financial

Potential:

Business interruption

Incident-response costs

Recovery costs

Legal expenses

Regulatory consequences

Customer notification costs

Reputation

Trust can be damaged even when the technical recovery is successful.

This is the most important section for defenders.

🔴 Priority 1 — Secure Remote Access

Immediately review:

Internet-facing RDP

VPN

Remote desktop gateways

Remote administration tools

External management interfaces

Where RDP is not required:

Disable it.

Where remote access is required:

MFA

VPN/ZTNA

IP restrictions

Conditional access

Strong authentication

Monitoring

CISA specifically recommends restricting exposure of remote services and addressing vulnerable RDP configurations.

MFA should protect:

Email

VPN

Remote access

Cloud applications

Privileged accounts

Administrative interfaces

Where possible, organisations should move toward phishing-resistant authentication, such as FIDO2 security keys or device-bound passkeys.

The FBI currently recommends prioritising phishing-resistant authentication for administrators, executives and other high-impact accounts.

Endpoint detection should identify behavioural patterns rather than simply known malware hashes.

Monitor for:

PowerShell anomalies

Suspicious command-line execution

Shadow-copy deletion

Security-service termination

Unusual process trees

Mass file modification

Suspicious remote execution

Credential abuse

Ransomware-like file activity

This is non-negotiable.

Follow a resilient backup strategy such as:

3-2-1

3 copies

2 different media

1 offline/isolated or immutable copy

Backups must also be:

Tested.

A backup that has never been successfully restored is not a recovery strategy.

The FBI recommends maintaining offline/isolated backups and regularly verifying that backups can actually be restored.

Do not allow:

One compromised workstation → entire organisation.

Separate:

User networks

Server networks

Database systems

Backup infrastructure

Domain controllers

Administrative networks

Critical applications

Apply least-privilege communication between segments.

CISA specifically recommends network segmentation to limit ransomware lateral movement.

Because ransomware operators frequently target identity infrastructure, organisations should review:

Domain Admin membership

Privileged accounts

Service accounts

Dormant accounts

Password policies

Delegation

Group membership changes

New administrator creation

Unusual authentication patterns

Implement:

Least privilege + separate admin accounts + MFA + privileged access monitoring.

SOC teams should create detections for:

Identity

Impossible travel

New device

Unusual login

Authentication from unfamiliar IP

Multiple failed logins followed by success

Endpoint

Suspicious PowerShell

vssadmin execution

wbadmin execution

bcdedit modification

Security-service termination

Unusual Safe Mode activity

Network

Unexpected SMB traffic

RDP lateral movement

New remote administration tools

Large outbound data transfers

File system

Rapid mass file modification

Unusual file extensions

Large-scale file renaming

Encryption-like behaviour

Because current intelligence specifically reports nine extracted emails, organisations should treat email as an important investigative area.

Review:

Mailbox login history

OAuth applications

Inbox rules

Forwarding rules

Delegated access

Suspicious attachments

Deleted messages

External forwarding

Impossible-travel authentication

Password-reset activity

If an account is suspected to be compromised:

Revoke sessions and tokens → reset credentials → remove malicious rules → review OAuth access → investigate historical activity.

If an organisation identifies active ransomware:

STEP 1 — Isolate

Immediately isolate affected endpoints.

Do not blindly shut down every system before preserving evidence unless operational safety requires it.

STEP 2 — Protect the Identity Layer

Disable or reset compromised accounts.

Revoke:

Sessions

Tokens

VPN access

Remote sessions

STEP 3 — Stop Lateral Movement

Block:

RDP

SMB

Remote administration

Suspicious IP addresses

Known malicious infrastructure

STEP 4 — Protect Backups

Immediately verify whether backup infrastructure has been accessed.

Isolate backup systems if necessary.

STEP 5 — Preserve Evidence

Collect:

EDR telemetry

Windows Event Logs

Authentication logs

VPN logs

Firewall logs

DNS logs

Proxy logs

Cloud audit logs

Email logs

Memory/disk evidence where appropriate

STEP 6 — Determine Scope

Identify:

Patient zero → compromised accounts → compromised endpoints → lateral movement → data accessed → data exfiltrated → ransomware deployment.

STEP 7 — Recover

Restore from known-good backups only after confirming that the attacker has been removed.

One of the biggest mistakes during ransomware response is:

Encrypt → wipe → restore → done.

If the attacker still has valid credentials or persistence, the organisation may simply be reinfected.

Before recovery:

Confirm:

Attacker access removed

Compromised credentials rotated

Persistence removed

Malicious accounts removed

RDP exposure fixed

Vulnerabilities patched

EDR operational

Network segmentation enforced

Backups clean

Then begin restoration.

Maintain an accurate inventory of:

Internet-facing servers

VPN appliances

Firewalls

Remote access systems

Web applications

Operating systems

Third-party software

Prioritise known exploited vulnerabilities.

The FBI recommends risk-based vulnerability management with asset ownership, defined remediation timelines and authenticated scanning.

For organisations managing large amounts of sensitive customer information, ransomware defence should extend beyond endpoint protection.

Security teams should specifically examine:

Identity

Can an attacker compromise one employee and reach critical systems?

Email

Can one compromised mailbox expose sensitive documents?

Data

Can users access significantly more information than required for their job?

Network

Can one workstation communicate directly with critical servers?

Backups

Can a domain administrator delete backups?

Monitoring

Would the SOC notice abnormal data access before encryption?

These questions are more valuable than simply asking:

“Do we have antivirus?”

Day 1–2

Exposure Assessment

Identify:

Internet-facing systems

RDP exposure

Vulnerable assets

Privileged accounts

Day 3

Identity Security

Review:

MFA

Admin accounts

Dormant accounts

Service accounts

Day 4

Endpoint Security

Validate:

EDR coverage

Alerting

Tamper protection

Logging

Day 5

Backup Security

Perform:

Backup integrity test

Restoration test

Backup privilege review

Day 6

Network Segmentation

Identify:

Flat networks

Unnecessary SMB/RDP

Critical server exposure

Day 7

Tabletop Exercise

Simulate:

“MedusaLocker has compromised an employee workstation.”

Ask the team:

How quickly can we detect, isolate, investigate and recover?

The Licindia listing demonstrates an important reality of the current ransomware environment:

Ransomware is no longer simply a malware problem.

It is an:

Identity problem

Remote-access problem

Network-segmentation problem

Data-security problem

Backup problem

Incident-response problem

The ransomware executable may be the final visible component of an attack that began much earlier.

The best defensive strategy is therefore:

Detect the intrusion before the encryption stage.