Federal authorities warn MedusaLocker ransomware targeting remote desktop vulnerabilities

MedusaLocker uses a batch file to execute a PowerShell script, called invoke-Reflective PEInjection. Attacks typically restart machines in safe mode to avoid detection by security software.