FortiGuard Labs is aware of a report that a new Medusa malware variant that is targeting Linux-based devices. The Medusa malware is reportedly based on the infamous Mirai malware and is not only capable of launching Distributed Denial of Service (DDoS) attacks and exfiltrating information from compromised devices, but also encrypting files and deleting all files in the system drives.Why is this Significant?This is significant because Medusa botnet supports ransomware functionality and is capable of encrypting files on compromised Linux devices. It also deletes files on the hard disk 24 hours after file encryption is finished, which bricks the affected devices.What is Medusa Malware?Medusa is a Mirai variant that connects to Command-and-Control (C2) servers, and perform various activities upon receiving commands from C2s. Capabilities include – launching DDoS attacks and exfiltrating information from compromised devices. It can also encrypt files on compromised devices and delete all files in the system drives 24 hours after file encryption is completed, which would make the affected devices unusable.While infection chain of Medusa botnet has not been identified, exploiting vulnerabilities is the likely infection vector since Medusa ransomware is reportedly based on the infamous Mirai malware. Bruteforcing is another potential attack vector as Linux devices often have weak username passwords combination by default and users tend not to change default passwords.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for this attack:Linux/Redis.TSU!trPython/Stealer.DEDC!tr.ransomBAT/Agent.P!tr.dldrFortiGuard Labs has the following IPS signature in place to block download of Medusa malware:Embedded.Linux.Malicious.Script
More Stories
libcoap-4.3.5-6.fc41
FEDORA-2024-9c7bbee0f0 Packages in this update: libcoap-4.3.5-6.fc41 Update description: Update to 4.3.5 GA Read More
chromium-128.0.6613.119-1.fc39
FEDORA-2024-1bd7266df0 Packages in this update: chromium-128.0.6613.119-1.fc39 Update description: update to 128.0.6613.119 High CVE-2024-8362: Use after free in WebAudio High CVE-2024-7970:...
chromium-128.0.6613.119-1.el8
FEDORA-EPEL-2024-c15e47ae56 Packages in this update: chromium-128.0.6613.119-1.el8 Update description: update to 128.0.6613.119 High CVE-2024-8362: Use after free in WebAudio High CVE-2024-7970:...
chromium-128.0.6613.119-1.el9
FEDORA-EPEL-2024-7f86a25567 Packages in this update: chromium-128.0.6613.119-1.el9 Update description: update to 128.0.6613.119 High CVE-2024-8362: Use after free in WebAudio High CVE-2024-7970:...
chromium-128.0.6613.119-1.fc41
FEDORA-2024-e109b67926 Packages in this update: chromium-128.0.6613.119-1.fc41 Update description: update to 128.0.6613.119 High CVE-2024-8362: Use after free in WebAudio High CVE-2024-7970:...
chromium-128.0.6613.119-1.fc40
FEDORA-2024-ee42af5a22 Packages in this update: chromium-128.0.6613.119-1.fc40 Update description: update to 128.0.6613.119 High CVE-2024-8362: Use after free in WebAudio High CVE-2024-7970:...