Medusa ransomware group targets The International Civil Defense Organization

• Ransomware group: Medusa
• Country: Switzerland
• Sector: Government & Defense
• Announcement date: August 19, 2023

Medusa ransomware group claims data breach at The International Civil Defense Organization

The Medusa ransomware group has listed The International Civil Defense Organization on its leak site, claiming to have obtained data belonging to the intergovernmental entity. The announcement, which appeared on August 19, 2023, suggests a significant breach targeting the organization's digital infrastructure.

Details of the alleged attack and ransom demand

According to the claims made by the Medusa group, the organization was targeted on August 19, 2023. The threat actors are demanding a ransom of 100,000 USD in exchange for the data they claim to have exfiltrated from the organization. To support their claims, the group has provided screenshots containing samples of various documents and certificates related to the activities of The International Civil Defense Organization.

The shared samples indicate that the compromised information includes sensitive documentation. Specifically, the data samples identified in the leak include:

• Training certificates
• Personal identification data

About The International Civil Defense Organization

The International Civil Defense Organization (ICDO) is an intergovernmental organization dedicated to promoting the development of structures by states to protect the population, property, and the environment from natural or man-made disasters. Founded in 1931, the organization plays a critical role in coordinating international cooperation within the field of civil defense to mitigate the impact of various disasters.

Analysis and potential impact of the breach

The Medusa group is identified as a Ransomware-as-a-Service (RaaS) entity. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. Medusa has been tracked since 2021 and launched its specific leak site in 2023. This group frequently employs double extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to publish the sensitive information on a public leak site if the ransom is not paid.

The threat of publishing sensitive data increases the risk of identity theft or targeted phishing attacks directed at the organization's personnel and members. Given that the target is an international organization, the breach could potentially have negative impacts on the organization's operational credibility. Furthermore, the data breach may lead to compliance issues regarding relevant international data protection standards and privacy protocols.

Considering the group's past activities, there is a possibility that the data will be made public if the ransom is not paid. For organizations in the government and defense sector, such incidents highlight the importance of robust defensive measures. Common defensive steps include maintaining regular, offline backups, implementing strict access controls, and conducting regular security awareness training to defend against phishing. As ransomware groups continue to evolve, maintaining high standards of cybersecurity is essential for protecting organizational integrity and sensitive personal information.