Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
24 IOCs
CISA Warns of Medusa Ransomware-as-a-Service Attacks Over 300 Organizations
Malware Families
Excerpt
The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) have issued a joint advisory warning that Medusa ransomware operators continue to target critical infrastructure organizations through data theft, endpoint security evasion, and network-wide encryption operations. Tracked as AA25-071A, the #StopRansomware advisory says Medusa developers and affiliates had…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →24 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 23.234.93.112 | High | Score 58/100 | First seen |
| IP | 167.88.166.173 | Medium | Score 65/100 | First seen |
| IP | 23.234.106.242 | High | Score 58/100 | First seen |
| IP | 37.221.66.239 | High | Score 58/100 | First seen |
| IP | 185.135.86.185 | High | Score 58/100 | First seen |
| IP | 185.238.231.16 | High | Score 58/100 | First seen |
| IP | 94.156.67.145 | High | Score 58/100 | First seen |
| CVE | CVE-2023-48788 | Medium | Score 53/100 | First seen |
| IP | 146.70.172.247 | High | Score 58/100 | First seen |
| IP | 85.155.186.121 | High | Score 61/100 | First seen |
| IP | 23.234.89.195 | High | Score 58/100 | First seen |
| IP | 83.138.53.139 | High | Score 58/100 | First seen |
| IP | 185.238.231.85 | High | Score 58/100 | First seen |
| IP | 155.2.215.69 | High | Score 58/100 | First seen |
| IP | 143.244.47.89 | High | Score 58/100 | First seen |
| IP | 185.238.231.98 | High | Score 58/100 | First seen |
| IP | 155.2.215.71 | High | Score 58/100 | First seen |
| IP | 185.238.231.4 | High | Score 58/100 | First seen |
| IP | 185.238.231.77 | High | Score 58/100 | First seen |
| Domain | erp.ranasons.com | Medium | Score 60/100 | First seen |
| IP | 37.19.21.180 | High | Score 58/100 | First seen |
| CVE | CVE-2024-1709 | Medium | Score 59/100 | First seen |
| URL | http://45.61.150.94:8000/storm.exe | High | Score 58/100 | First seen |
| IP | 143.110.243.154 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…