They Paid Medusa's Ransom. A Second Medusa Actor Called and Demanded Half Again.

The FBI documented a Medusa ransomware victim who paid the ransom—and was then contacted by a second, separate Medusa actor, claiming the original negotiator had stolen the payment and demanding half the ransom again for the "true" decryptor.

That's triple extortion, and it's the strongest argument in the whole CISA/FBI/MS-ISAC advisory (AA25-071A) against paying at all. There is no guarantee the extortion stops when the money moves.

Read SafeBreach Lab's full coverage here: https://www.safebreach.com/blog/safebreach-coverage-us-cert-aa25-071a-medusa-ransomware/

#MedusaRansomware #ransomware #cybersecurity #infosec #CISO #tripleextortion #cyberresilience