FBI Urges Immediate Action: Double-Up Security for Email and VPN

At a glance

• The FBI urged organizations to protect email and VPN accounts with Two-Factor Authentication (2FA).
• The warning came in a joint advisory on the Medusa ransomware group.
• Medusa had hit more than 300 victims in critical infrastructure sectors.
• The advisory recommends 2FA, strong passwords, prompt patching and staff training.
• Security researchers say these basics stop many ransomware attacks.

What the FBI is warning about

The Federal Bureau of Investigation, together with CISA and MS-ISAC, issued a joint advisory in March 2025 about the Medusa ransomware group. One recommendation stood out: protect webmail, Virtual Private Networks (VPNs) and other critical systems with Two-Factor Authentication (2FA) right away. Medusa had attacked more than 300 victims by February 2025, in sectors including healthcare, education, legal, insurance, technology and manufacturing.

Who Medusa targets

Medusa runs as a ransomware-as-a-service operation. Affiliates break into networks, steal data and encrypt systems, then threaten to publish the stolen files unless a ransom is paid. Their entry points are familiar: phishing emails and unpatched software.

That is why the advisory focuses on email and remote access. A stolen password for either can hand an attacker the whole network.

VPNs Under Siege

Virtual Private Networks are meant to protect remote access, but they are also a favorite target. A VPN login protected only by a password is an open door if that password leaks or is guessed.

Implementing Two-Factor Authentication

2FA adds a second check, such as a code from an app or a hardware key, before anyone can log in. That sharply reduces the risk of unauthorized access. A single password is no longer enough protection on its own.

It also slows attackers down. Even a correct stolen password stops working without the second factor.

Beyond 2FA: Holistic Security Measures

2FA is one part of a broader defense. The advisory also recommends long passwords, prompt patching of known flaws and network segmentation, so that one compromised system does not expose the rest.

Password managers, encryption and regular audits complement 2FA and make it much harder for intruders to move around a network.

The Role of Education and Vigilance

Training matters too. Staff who know how phishing works are less likely to hand over their credentials, and a culture where people report suspicious messages quickly helps security teams act early.

Awareness is only the start. Organizations have to follow through by turning on 2FA, patching and checking that both stay in place.

Steps to take this week

The FBI’s warning is a practical one. Turn on 2FA for email and VPN accounts, patch internet-facing systems and back up critical data offline. These steps are not new. They are still the ones that stop most ransomware crews.

Attackers keep changing their methods, so defenses need regular review. The message from the FBI is clear: act now rather than after an attack.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.