CISA: Medusa ransomware hit over 500 critical infrastructure orgs

Medusa ransomware has impacted over 500 critical infrastructure organizations as of April 2026, according to a new FBI advisory. An earlier US government advisory on the ransomware-as-a-service (RaaS) operation, published in March 2025, reported that Medusa affiliates had hit over 300 critical infrastructure organizations as of February 2025. The updated advisory, published on August 18, and jointly produced by the FBI, CISA and the Department of Health and Human Services, noted that the healthcare industry has been especially frequent target of Medusa actors. The report also highlighted that since February 2025, the operation has expanded its techniques and tooling to significantly enhance its initial access and post-exploitation activities. The Medusa ransomware variant was first detected in June 2021. It originally operated as a closed ransomware operation, before moving to an affiliate model in at least early 2023. Medusa Speeds Up Vulnerability Exploitation The US agencies noted that Medusa continues to exploit unpatched vulnerabilities as its primary means of initial access. More recently, the group has been observed leveraging exploits within 24 hours after they have been announced, before many victims have had a chance to apply patches. In some cases, Medusa actors have used exploits up to a week before public vulnerability disclosure, the advisory said. The RaaS group has been described as opportunistic in nature, targeting victims with unpatched software rather than focusing on specific organizations or sectors. There is no indication that Medusa actors develop their own zero-day or N-day vulnerabilities. Another development in Medusa’s tactics is the use of Interactsh dynamic URLs to verify successful exploitation by identifying compromised hosts. Nick Tausek, lead security automation architect at Swimlane, warned that Medusa’s rapid exploitation capabilities is creating significant challenges for security teams. “Shrinking windows put far more pressure on defenders to identify and remediate exposed systems before Medusa can take advantage. Dangerous levels of speed can turn a newly disclosed flaw into an active intrusion before many security teams have even finished assessing their exposure,” he commented. Updated Stealth and Lateral Movement Abilities Medusa actors have also improved their post-exploitation capabilities, including hiding their presence in networks, bypassing defenses, moving laterally and accessing sensitive data from networks. The FBI advisory said the group deploys several different PowerShell stealth techniques with increasing complexity, enabling them to obfuscate payloads. They also attempt to cover their tracks by deleting the PowerShell command line history. Numerous new tools have been used to support command and control (C2) and stealth. These include publicly available tools like Nezha, an operations and maintenance server monitoring tool used to allow backdoor visibility to compromised hosts from the threat actor’s machine, and GSocket, which allows workstations on different private networks to connect and bypass firewalls. Medusa also deploys a range of legitimate remote monitoring and management (RMM) software, selecting those already present in the victim’s environment to evade detection. These tools are used to move laterally through the network and identify files for exfiltration. Windows Task Manager Mimikatz is used to harvest credentials, including stealing them directly from the LSA authentication mechanism, which allows them to record plaintext passwords to a log file. Andrew Costis, engineering manager at AttackIQ, said the advisory demonstrates that Medusa has significantly updated its playbook with techniques that are more difficult for security teams to counter. “The group is blending legitimate remote management tools into its operations while using new credential theft methods and overriding security policies to maintain access,” he said. “Stolen Active Directory files are especially concerning because they can be used to forge Kerberos tickets. At that point, Medusa isn’t just encrypting systems. It can potentially impersonate trusted users and move through an entire domain with far fewer obstacles.” Medusa Exfiltration and Extortion Methods Medusa actors install and use Bandizip to create archives of exfiltration files and Rclone to facilitate exfiltration of data to the Medusa C2 servers, while obfuscating rclone.exe and associated rclone.conf files by renaming the files. Secure file transfer protocol (SFTP) is used to transfer its encryptor to victim machines. The encrypted files have a .medusa file extension, which terminates all services and deletes shadow copies before dropping a ransom note to the victim. This approach allows Medusa to adopt a double-extortion model, demanding that victims pay both to restore their systems and data and to prevent their data being published online. The ransom note typically demands that victims make contact within 48 hours, with Medusa actors often contacting them directly via phone or email if they have not responded to the ransom note. Ransom demands are posted on Medusa’s leak site, with direct hyperlinks to Medusa-affiliated cryptocurrency wallets. FBI Urges Victims to Focus on Incident Response Alongside prevention and mitigation measures outlined in the earlier Medusa advisory, the advisory recommended that security teams develop techniques that allows them to respond effectively when an intrusion occurs. These include: Use threat hunting activities to scope the intrusion, including logs left behind by threat actor tooling Remove C2 software like Nezha or any other remote access method used by the organization Remove local administrator accounts and rotate credentials for service accounts and domain administrator accounts Ensure the initial intrusion CVE is patched Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan

Medusa ransomware gang has hit over 500 organizations, CISA warns Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory. The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026. “Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors,” the advisory reads, listing healthcare, defense, manufacturing, government services, IT, and financial services among those hit. Victims outside those sectors span education, insurance, and law firms. “Medusa originally operated as a closed ransomware operation, meaning the same group of cyber threat actors controlled all development and associated ransomware campaigns. Since at least early 2023, Medusa progressed to using an affiliate model, selling RaaS to affiliates who are granted varying levels of trust based upon experience and profitability,” they said. The gang buys access from initial access brokers on cybercriminal forums, paying between $100 and $1 million, and most of those brokers aren’t exclusive to Medusa. “Most IABs, however, appear to be willing to work for multiple variants at the same time,” the advisory states. Medusa relies on common techniques, phishing to steal credentials and unpatched software to gain access. The advisory names flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust as recent targets, and notes that affiliates move fast once a vulnerability goes public. “Medusa actors leverage newly announced exploits within 24 hours,” the advisory notes, adding that there’s no sign the group develops its own zero-days. Once inside, the group leans on tools already present on a network rather than custom malware, among them PowerShell, Mimikatz for stealing credentials, and remote access software like AnyDesk and SimpleHelp. A process called gaze.exe handles the encryption itself, shutting down backup and security services before locking files with a .medusa extension. Medusa follows a double-extortion model. According to the agencies, victims get 48 hours to respond to a ransom note before Medusa starts contacting them directly, and their stolen data goes up on a leak site with a countdown timer. Paying $10,000 in cryptocurrency buys another day. The agencies recommend patching internet-facing systems, segmenting networks to limit lateral movement, and blocking untrusted traffic from reaching remote access services. They continue to discourage paying ransoms, and encourage victims to report incidents to the FBI’s Internet Crime Complaint Center or CISA.

The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. This was revealed in a joint advisory in coordination with the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI). "As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services," they said. "Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries." This is an update to a joint report published in March 2025, which said the Medusa ransomware operation had impacted an estimated over 300 critical infrastructure organizations. The three federal agencies recommended that network defenders secure their networks against the ransomware group's attacks by mitigating security vulnerabilities to protect operating systems, software, and firmware from exploitation attempts. Security teams are also advised to segment networks to block lateral movement after compromise and to block access from untrusted origins to remote services on internal systems. Active since January 2021 The Medusa ransomware operation surfaced five years ago, in January 2021. Still, the gang's activity only picked up in 2023 after launching the Medusa Blog leak site and began using stolen data as leverage to pressure victims into paying ransoms. Medusa emerged as a closed ransomware variant, but it evolved into a Ransomware-as-a-service (RaaS) operation and adopted an affiliate model. "Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims," the advisory says. "Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa." Medusa is a common name among malware families and cybercrime operations, including a Mirai-based botnet with ransomware capabilities and an Android malware-as-a-service (MaaS) operation discovered in 2020 and also tracked as TangleBot. Because of this, reporting on Medusa ransomware has also often been ambiguous, with many confusing it with the widely known MedusaLocker ransomware operation, even though they are different operations. The Medusa cybercrime operation gained media attention in March 2023 after claiming an attack on the Minneapolis Public Schools (MPS) district and sharing a video of the stolen data. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

More than 200 victims of Medusa ransomware identified over the last year, CISA says Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang have been identified over the last year. The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims. CISA previously said 300 victims, many of which are in critical infrastructure sectors, were attacked as of 2025. The group caused widespread outrage in April when it shut down the University of Mississippi Medical Center — Mississippi’s only children's hospital, only Level I trauma center, only Level IV neonatal intensive care unit and home to the state’s only organ transplant program. Tuesday’s advisory warned that the group has focused its efforts on the healthcare sector and has become adept at exploiting “newly announced exploits within 24 hours.” The ransomware gang has “been observed to use exploits up to a week before public vulnerability disclosure,” the agencies added, citing a recent report from Microsoft about the trend of Medusa actors targeting victims using software that has not been updated to include new patches. “However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching,” the advisory said. Medusa was originally a closed ransomware gang but transitioned to an affiliate model in 2023, selling its ransomware to hackers who are granted varying levels of access based on their experience and earnings. “For newer or less experienced affiliates, important operations such as ransom negotiation may be centrally controlled by the developers,” the agencies explained. Medusa actors typically offer lower ransoms to victims if they pay quickly but they often do research on companies before attacks, basing ransom amounts on publicly announced revenue. While Medusa does remove victim information from its site after a ransom is paid, the agencies noted that there is no way to verify whether it is truly deleted. Victims are often given an offer of $10,000 to add one extra day to the deadline before stolen data is released to the public. The advisory references one incident seen by FBI investigators where a victim was “contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid and requested half of the payment be made again to provide the ‘true decryptor’ — potentially indicating a triple-extortion scheme, or operational dysfunction and a lack of cohesion among ransomware group.” Medusa recruits members on cybercriminal forums and offers up to $1 million to initial access brokers who want to work exclusively for the group. CISA and the FBI included technical advice victims can turn to when investigating Medusa attacks, noting that the hackers use several credential stealing tools before turning to legitimate remote monitoring software to evade detection. The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop. Medusa has not added any new victims to its leak site since April, leading several experts to believe the attack on the University of Mississippi Medical Center drew significant, unwanted law enforcement attention to the group. The group, which emerged in 2021, has repeatedly shown a willingness to target healthcare facilities as well as international and U.S. municipal governments. The advisory’s focus on Medusa’s ability to quickly exploit zero-days drew the most interest from researchers, who warned that several groups are increasingly jumping on new vulnerabilities before defenders have a chance to install patches. “We’re seeing a clear escalation in the speed and coordination of operations… particularly in how quickly newly disclosed and even zero-day vulnerabilities are being operationalized,” said SafeBreach’s Adrian Culley. Culley added that the hackers tied to Medusa are “moving from initial access to data exfiltration in hours, not days.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.