CISA, FBI and HHS Update Medusa Ransomware Advisory as Victim Count Passes 500

The Medusa ransomware operation has now hit more than 500 organizations, up from roughly 300 a year ago, according to a joint advisory the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Department of Health and Human Services (HHS) updated on August 18, 2026. The three agencies used a year of fresh FBI casework to spell out how the group breaks in and what it does next, and the headline for defenders is speed: Medusa affiliates are now weaponizing new vulnerabilities faster than most patch cycles can close them.

The update expands an advisory (tracked as AA25-071A) that was first published in March 2025. At that point the agencies counted more than 300 victims across critical infrastructure. As of April 2026, the tally in the advisory reads more than 500, an increase of over 200 in roughly a year. HHS is a new co-author on this revision, reflecting how often healthcare organizations turn up on Medusa’s list. The Record and CyberScoop both reported the update on Tuesday.

One clarification worth making up front, because the name causes constant confusion: this Medusa is a ransomware-as-a-service (RaaS) operation active since 2021. The advisory states plainly that it is unrelated to the MedusaLocker variant and to the Medusa mobile malware (the Android banking trojan that shares the name). If you are triaging an alert, the distinction matters, because the detection and response steps are not the same.

What the Update Actually Adds

The substance of the revision is a clearer picture of Medusa’s access economy and its tempo. The group leans on initial access brokers (IABs) it recruits on criminal forums, paying anywhere from $100 to $1 million, with the top end reserved for brokers willing to work exclusively for Medusa. Most brokers, the advisory notes, sell to several ransomware crews at once, so the access pipeline is shared industry infrastructure rather than something Medusa owns outright.

The line defenders should sit with is about exploitation speed. Quoting the advisory directly: “Medusa actors leverage newly announced exploits within 24 hours and have been observed to use exploits up to a week before public vulnerability disclosure.” The agencies pair that with a caveat that matters for how you model the threat: there is “no indication Medusa actors develop their own zero-day or N-day vulnerabilities,” and they instead buy or quickly adopt exploits from other sources. In practical terms, Medusa is not a bespoke zero-day shop. It is a fast follower that wins on the gap between disclosure and patching.

How Medusa Gets In

Initial access falls into two well-worn buckets. The first is phishing to steal credentials. The second, and the one the update emphasizes, is exploiting unpatched, internet-facing software. The advisory names specific flaws Medusa affiliates have used, including the ConnectWise ScreenConnect authentication-bypass bug (CVE-2024-1709) and a Fortinet EMS SQL injection flaw (CVE-2023-48788). CyberScoop reported that the update also cites Fortra GoAnywhere and BeyondTrust vulnerabilities among the exploited software, the same GoAnywhere activity Microsoft has tied to the Medusa affiliate it tracks as Storm-1175.

That affiliate is the thread connecting this advisory to Medusa’s recent behavior. Earlier this year we covered Microsoft’s reporting on Storm-1175 driving high-velocity Medusa operations against web-facing assets, sometimes moving from exploitation to encryption inside a day. The government advisory now formalizes that pattern into named CVEs and defender guidance.

The Medusa intrusion chain, stage by stage, with the defensive control that interrupts each step. Alt text: a vertical five-stage flow from initial access through impact, four purple stages and a red final impact stage, each labeled with a defender action.

What Happens Once They Are Inside

Post-compromise, Medusa favors quiet. The advisory describes heavy use of living-off-the-land techniques and legitimate administration tools so activity blends into normal operations. Affiliates use PowerShell and the Windows command shell for enumeration, Advanced IP Scanner and SoftPerfect Network Scanner to map the network, and Mimikatz to dump credentials from LSASS memory. Movement across the network runs on Remote Desktop Protocol, PsExec, and whichever remote-access product is already installed. The FBI lists AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop among those observed.

Data leaves before files lock. Medusa installs Rclone to exfiltrate to its own command-and-control storage, then deploys an encryptor named gaze.exe that terminates backup, security and database services, deletes volume shadow copies, and encrypts with AES-256, leaving a .medusa extension. Then comes the pressure campaign. Medusa runs a double-extortion model on a .onion leak site with a countdown, and victims can pay $10,000 to add a single day to that clock. The advisory also documents one case that hints at a triple-extortion twist, or simple dishonesty among criminals: a victim who had already paid was contacted by a second Medusa actor claiming the original negotiator stole the money and demanding half the ransom again for the “true decryptor.”

My Read

My read: the number that should reset your planning is not 500 victims, it is 24 hours. A group that operationalizes public exploits within a day, and occasionally before disclosure, breaks the comfortable assumption that a monthly patch cycle is fast enough for internet-facing systems. This is an assessment, not a claim from the advisory: for most organizations the practical defense is narrowing the exposed edge (fewer internet-facing services, faster emergency patching for the ones that remain, and MFA everywhere) rather than hoping to out-detect an intrusion that reaches encryption in hours. The healthcare emphasis, and HHS signing on, is a signal that hospitals in particular should treat this as an operational-continuity risk, not just an IT one.

What Defenders Should Do Now

• Read the TTPs, then map your gaps. Pull the MITRE ATT&CK techniques and indicators from AA25-071A and test your controls against them, especially detection for PowerShell abuse, PsExec, and Rclone exfiltration.
• Verify patch level on internet-facing services. Prioritize CISA’s Known Exploited Vulnerabilities on anything exposed, and confirm the named products are current: ConnectWise ScreenConnect (CVE-2024-1709), Fortinet EMS (CVE-2023-48788), Fortra GoAnywhere, and BeyondTrust.
• Hunt for the Medusa IOCs. Check for the file hashes, the gaze.exe encryptor, openrdp.bat, and the ransom-negotiation email addresses listed in the advisory, and flag any remote-access tool (AnyDesk, Atera, SimpleHelp, Splashtop) that IT did not install.
• Require MFA and tighten remote access. Enforce multifactor authentication on webmail, VPNs and admin accounts, put remote access behind VPNs or jump hosts, and filter untrusted origins away from internal remote services.
• Make backups survivable. Keep offline, encrypted, immutable backups and rehearse restoration, because Medusa deliberately kills backup services and deletes shadow copies before encrypting.

What Is Not Confirmed

The advisory deals in patterns, not a roster. It does not name the more than 500 victims, and it does not publish an aggregate ransom figure, so any specific dollar total circulating elsewhere is not government-sourced. The University of Mississippi Medical Center attack in April, which took the state’s only children’s hospital offline, was reported by The Record rather than named in the advisory itself. Medusa has not posted a new victim to its leak site since April, which some researchers read as fallout from the law-enforcement attention that attack drew, though the group’s dwell time makes a quiet stretch a poor proxy for a slowdown.

Primary documents

• FBI/CISA/HHS joint advisory: #StopRansomware Medusa (AA25-071A)
• The Record: More than 200 Medusa victims identified over the last year, CISA says
• CyberScoop: Medusa ransomware tallies hundreds of new victims
• Microsoft Threat Intelligence: Storm-1175 high-tempo Medusa operations