FBI warns Gmail, Outlook, and VPN users of Medusa ransomware threats

Efe Udin

March 15, 2025

The FBI has warned about a rising ransomware threat, naming the Medusa ransomware group as a major risk to people and businesses. Along with CISA, the FBI has shared key steps to reduce the threat, urging quick action to secure critical systems. Gmail, Outlook, and VPN users need to take this warning seriously to keep their data safe and secure.

Medusa ransomware poses a significant threat

Medusa is a ransomware-as-a-service (RaaS) group that has been active since at least June 2021. It has hit over 300 victims, especially in critical infrastructure. The group uses social engineering and exploits unpatched software flaws to break into systems.

FBI investigations into Medusa’s actions, as recent as February 2025, have given key insights into how the group works. The agency has gathered details on their tactics, techniques, procedures, and signs of compromise. These are now part of a joint cybersecurity advisory, labeled AA25-071A, released on March 12.

Experts highlight how advanced Medusa’s methods are. Tim Morris, chief security advisor at Tanium, said the group’s name fits well, given its “multi-faceted and far-reaching impacts on various industries.” He stressed that Medusa excels at “exploitation, persistence, lateral movement, and concealment,” making it vital for organizations to have a strong, all-around security plan.

Jon Miller, CEO and co-founder of Halcyon, called Medusa a highly strategic group that “focuses on gaining leverage to extort organizations.” He said critical infrastructure groups are top targets because they can’t afford downtime. Medusa attackers exploit security gaps to gain higher access, steal data, and launch ransomware.

“Once inside a network,” Miller explained, “Medusa uses advanced methods to cause the most damage.” The group uses base64-encoded PowerShell commands to avoid detection and tools like Mimikatz to steal login details. It also uses remote access tools like AnyDesk and ConnectWise to spread across networks.

Join GizChina on Telegram

FBI issues urgent mitigation advice

The FBI has shared urgent steps to fight the growing threat of Medusa ransomware. They urge all groups to act fast to lower their risk of attack. The major advice is to turn on two-factor authentication (2FA) for all services, especially webmail (like Gmail and Outlook) and VPNs. The FBI says to do this “now.” Stay safe, stay secure.

Other key tips to stay safe include

Use long, strong passwords for all accounts. Avoid changing them too often, as this can make them less secure.

Keep multiple backups of key data in different, secure locations. Make sure they are separate and safe.

Always update your systems, software, and firmware. Focus on fixing known issues first.

Use tools to watch your network for strange activity or signs of ransomware spreading.

Block unknown sources from scanning or accessing your systems.

Limit who has admin access and regularly check these accounts.

Turn off the command-line and scripting tools you don’t need.

Close any unused network ports to lower the risk of attacks.

Experts criticize the FBI’s advice

The FBI’s advice on cybersecurity is helpful, but some experts say it misses a key point: training. Roger Grimes, a security expert at KnowBe4, notes that most ransomware attacks happen because of human mistakes. Teaching people to spot risks is just as important as technical fixes. Simple steps, like learning to avoid phishing, can make a big difference. Stay smart, stay safe.

“Medusa spreads using social engineering, yet the FBI does not suggest security awareness training as a primary way to defeat it,” Grimes stated. According to KnowBe4’s research, social engineering is a factor in 70% to 90% of successful hacking incidents. Despite the FBI acknowledging social engineering as a primary attack method, its official recommendations do not include specific guidance on improving user awareness.

Grimes compared this oversight to “learning that criminals are breaking into your house all the time through the windows and then recommending more locks for the doors.” He argued that failing to address human vulnerabilities allows ransomware operators to continue their attacks successfully. “The hackers must be laughing,” he concluded.

A call for comprehensive cybersecurity measures

The Medusa ransomware threat shows why we need strong cybersecurity. Tools like 2FA, updates, and network checks are key. But teaching staff about risks is just as important, though often forgotten. Workers must learn to spot phishing and other tricks to stop attacks before they start. As ransomware groups get smarter, our defenses must too. The FBI’s recent warning reminds us that everyone—people and businesses—must act to protect their systems from growing cyber threats. Keep it simple: stay alert, stay safe.

Disclaimer: We may be compensated by some of the companies whose products we talk about, but our articles and reviews are always our honest opinions. For more details, you can check out our editorial guidelines and learn about how we use affiliate links.

Source/VIA :

Forbes