Medusa Ransomware Strikes Ainsworth Game Technology

Incident Date: Dec 11, 2024

Attack Overview
VICTIM
Ainsworth Game Technology Limited
INDUSTRY
Manufacturing
LOCATION
Australia
ATTACKER
Medusa
FIRST REPORTED
December 11, 2024

Medusa Ransomware Group Targets Ainsworth Game Technology

The Medusa ransomware group has claimed responsibility for a cyberattack on Ainsworth Game Technology Limited, a leading Australian company in the gaming machine manufacturing sector. This attack highlights the growing threat of ransomware groups targeting prominent organizations across various industries.

About Ainsworth Game Technology

Ainsworth Game Technology, founded in 1995 by Len Ainsworth, is a significant player in the gaming industry, specializing in the design, development, manufacturing, and servicing of gaming machines. Headquartered in Newington, Sydney, the company operates globally with offices in North America, Europe, and Latin America. Ainsworth is known for its innovative gaming solutions, including popular gaming machines like the A-Star Curve XL and titles such as Mustang Money. The company employs approximately 297 individuals and reported an annual revenue of AUD 284.86 million for the fiscal year ending December 31, 2023.

Details of the Ransomware Attack

The Medusa group claims to have exfiltrated 852.40 gigabytes of sensitive data from Ainsworth, including business documents, confidential information, and personal employee data. The stolen data reportedly spans Ainsworth's global operations, with a significant portion originating from Australia. Medusa has demanded a ransom of $1.2 million, with a deadline set for December 24, and has threatened to release the data if the demand is not met. The group is also offering the data for sale at the same price. As of now, Ainsworth has not publicly addressed the breach.

Medusa Ransomware Group Profile

Medusa, active since 2021, operates under a Ransomware-as-a-Service model, targeting a diverse range of organizations. The group is known for its rapid encryption capabilities using AES-256 and RSA-2048 algorithms. Medusa typically gains access through phishing emails and exploits vulnerabilities in software such as FortiClient EMS and Citrix ADC. The group employs advanced evasion techniques, including disabling antivirus software and using legitimate administrative tools to maintain stealth within victim networks.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.