Medusa ransomware now operates as a RaaS model, recruiting affiliates from criminal forums to launch attacks, encrypt data, and extort victims worldwide.

According to a cybersecurity advisory, Medusa relies on a “double extortion model” that encrypts a victim’s data then threatens to release it publicly. In the past week, law enforcement agencies including the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a warning about the ongoing threat of Medusa ransomware.

Federal authorities have issued an advisory warning people of Medusa ransomware that has breached the data of more than 300 people since February.