Aurora, Illinois Investigates Sophisticated Cyber Attack Resulting in Fraudulent ACH Payments The city of Aurora, Illinois, is investigating a cyber attack that led to unauthorized ACH transactions from city accounts, discovered on April 30 just one day after the fraudulent activity occurred. Mayor John Laesch described the incident as a "very sophisticated cyber attack," though city officials maintain that internal systems were not compromised. While the exact financial loss remains undisclosed, authorities, including the Aurora Police Department and the FBI, are actively working to determine the total amount stolen. The city has taken immediate steps to mitigate the impact, recovering some funds and expressing optimism about further recovery efforts. Aurora also holds insurance to cover such incidents. The fraudulent transactions involved ACH (Automated Clearing House) payments, which require only a bank account and routing number commonly used for business bill payments. Due to the ongoing investigation, details about potential disciplinary actions, specific departmental involvement, or personnel matters have not been released. Aurora has partnered with cybersecurity firm NuHarbor Security, Inc., and implemented employee training programs, including KnowBe4’s cybersecurity courses and regular phishing exercises. The city has not publicly disclosed the incident until now, citing the active nature of the investigation. Law enforcement and cybersecurity professionals continue to collaborate on the case.

Medusa Ransomware Gang Targets Over 300 Critical Infrastructure Organizations in Global Campaign U.S. federal authorities—including the FBI, CISA, and MS-ISAC—have issued a joint cybersecurity advisory warning of a surge in attacks by the Medusa ransomware gang, which has compromised over 300 critical infrastructure organizations as of February 2025. The group, operating under a ransomware-as-a-service (RaaS) model, has rapidly escalated its operations since its emergence in 2021, becoming one of the most active threat actors in recent years. ### Tactics and Targets Medusa employs double extortion, encrypting victims’ systems while threatening to leak stolen data unless ransoms—ranging from $100,000 to over $40 million—are paid. In some cases, the gang has demanded additional payments for a "true decryptor," suggesting triple extortion tactics. Affiliates earn 70–80% of ransom payments, incentivizing widespread attacks. The group has targeted sectors including healthcare, education, legal, insurance, technology, and manufacturing, with notable victims such as: - Aurora City (Colorado) - Heartland Health Center (Nebraska) - Bell Ambulance (Wisconsin) - Laurens School District 56 (South Carolina) - CPI Books (UK) ### Infection Methods and Tools Medusa gains initial access through phishing campaigns and the exploitation of unpatched vulnerabilities, including: - CVE-2024-1709 (ScreenConnect) - CVE-2023-48788 (Fortinet EMS SQL injection) Once inside a network, the gang uses remote access tools (AnyDesk, Atera, Splashtop) and Windows services (RDP, PsExec) for lateral movement. It deploys Rclone for data exfiltration and gaze.exe for encryption, while disabling security software, terminating backups, and deleting shadow copies to hinder recovery. ### Encryption and Extortion Medusa encrypts files using AES-256, appending a .medusa extension, and leaves a ransom note demanding contact within 48 hours via Tor, Tox, or encrypted messaging. Victims who fail to respond face public data leaks on the gang’s .onion site, where stolen data is also auctioned. The group offers a $10,000 "extension fee" to delay publication by one day. ### Mitigation Efforts Authorities recommend patching vulnerabilities, network segmentation, MFA enforcement, and offline backups to reduce risk. The advisory underscores the group’s persistence and sophistication, particularly against critical infrastructure, where disruption can have cascading effects. Medusa’s rise to ninth in global ransomware activity (per NCC Group) and its 9% share of 2024 attacks (BlackFog) highlight its growing threat to organizations worldwide.