Threat Landscape Update: Ransomware-as-a-Service and Advanced Modular Malware

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo (linkedin.com/in/sherroddegrippo) is joined by Tori Murphy, Anna Seitz, and Chuong Dong to break down two threats: the modular backdoor PipeMagic and Medusa ransomware. They discuss how PipeMagic disguises itself as a ChatGPT desktop app to deliver malware, its sophisticated modular design, and what defenders can do to detect it.

The team also explores Medusa’s evolution into a ransomware-as-a-service model, its use of double extortion tactics, and the broader threat landscape shaped by ransomware groups, social engineering, and the abuse of legitimate tools.

In this episode you’ll learn:

•
Why modular malware is harder to detect and defend against

•
How attackers abuse vulnerable drivers to disable security tools

•
Why leak sites play a central role in ransomware operations

Some questions we ask:

•
How did Microsoft researchers uncover PipeMagic in the wild?

•
Why do ransomware groups often borrow names and themes from mythology?

•
What initial access techniques are commonly associated with Medusa attacks?

Resources:

View Anna Seitz on LinkedIn (linkedin.com/in/anna-seitz-65a41b88)

View Chuong Dong on LinkedIn (linkedin.com/in/chuong-dong)

View Sherrod DeGrippo on LinkedIn (linkedin.com/in/sherroddegrippo)

Related Microsoft Podcasts:

•
Afternoon Cyber Tea with Ann Johnson (afternooncybertea.com)

•
The BlueHat Podcast (bluehatpodcast.com)

•
Uncovering Hidden Risks (uncoveringhiddenrisks.com)

Discover and follow other Microsoft podcasts atnews.microsoft.com/podcasts/https://news.micro…

Get the latest threat intelligence insights and guidance at Microsoft Security Insider (nam06.safelinks.protection.outlook.com/?url=ht…)

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.