FBI and CISA Issue Warning for Gmail and Outlook Users About Medusa Ransomware

Recent warnings from the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have raised concerns about the security of popular email services like Gmail and Outlook. Authorities report that these platforms are particularly vulnerable to a dangerous ransomware dubbed ‘Medusa’ that has been breaching the data of hundreds of unsuspecting victims across various sectors since its launch in June 2021.

Medusa, as the ransomware variant is called, was first identified in June 2021, and since its inception has targeted users from multiple backgrounds including the medical, educational, legal, insurance, tech, and manufacturing fields, thereby reiterating the widespread implications of cyber threats.

The FBI and CISA’s joint advisory is part of a broader ‘#StopRansomware’ initiative that regularly publishes advisories detailing different ransomware variants and associated threat actors. These advisories aim to provide network defenders with a comprehensive understanding of recently observed tactics, techniques, and procedures (TTPs), as well as indicators of compromise (IOCs), to aid organizations in protecting against ransomware.

As of February 2025, Medusa’s cyberattacks have impacted more than 300 victims, indicating the gravity and scope of this threat. The Medusa developers typically recruit access brokers, paying them anywhere from $100 to $1 million to work for them. These affiliates then exploit unpatched software vulnerabilities and launch phishing campaigns to breach the data of potential victims.

Interestingly, a blog post by Symantec, a leading enterprise security software brand, has identified a group called Spearwing as the operator behind the ransomware. The group, like most ransomware operators, carries out double extortion attacks. They initially steal victims’ data before encrypting networks to exert more pressure on victims to pay the ransom. If the victims refuse to pay, the group threatens to publish the stolen data on their data leaks site, further endangering the security of sensitive information.

Spearwing has been active since early 2023 and has victimized hundreds of people, with around 400 victims listed on its data leaks site. The ransoms demanded by Spearwing using the Medusa ransomware have ranged from $100,000 to a staggering $15 million, revealing the severity of their crimes.

To help combat the Medusa ransomware, the FBI and CISA recommend several protective measures. These include developing a recovery plan to keep multiple copies of sensitive data in a secure location, requiring password logins for all accounts, mandating multifactor authentication, keeping all systems and software up-to-date, and segmenting networks to prevent rapid spread of ransomware. Additional recommendations include monitoring for unauthorized access attempts and keeping offline, encrypted backups of data.

In conclusion, it is imperative for all internet users, especially those using popular email services like Gmail and Outlook, to stay informed about potential threats and take the necessary precautions to protect their data against ransomware attacks.