Medusa ransomware gang has hit over 500 organizations, CISA warns

Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory.

The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026.

“Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors,” the advisory reads, listing healthcare, defense, manufacturing, government services, IT, and financial services among those hit. Victims outside those sectors span education, insurance, and law firms.

“Medusa originally operated as a closed ransomware operation, meaning the same group of cyber threat actors controlled all development and associated ransomware campaigns. Since at least early 2023, Medusa progressed to using an affiliate model, selling RaaS to affiliates who are granted varying levels of trust based upon experience and profitability,” they said.

The gang buys access from initial access brokers on cybercriminal forums, paying between $100 and $1 million, and most of those brokers aren’t exclusive to Medusa. “Most IABs, however, appear to be willing to work for multiple variants at the same time,” the advisory states.

Medusa relies on common techniques, phishing to steal credentials and unpatched software to gain access. The advisory names flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust as recent targets, and notes that affiliates move fast once a vulnerability goes public.

“Medusa actors leverage newly announced exploits within 24 hours,” the advisory notes, adding that there’s no sign the group develops its own zero-days.

Once inside, the group leans on tools already present on a network rather than custom malware, among them PowerShell, Mimikatz for stealing credentials, and remote access software like AnyDesk and SimpleHelp. A process called gaze.exe handles the encryption itself, shutting down backup and security services before locking files with a .medusa extension.

Medusa follows a double-extortion model. According to the agencies, victims get 48 hours to respond to a ransom note before Medusa starts contacting them directly, and their stolen data goes up on a leak site with a countdown timer. Paying $10,000 in cryptocurrency buys another day.

The agencies recommend patching internet-facing systems, segmenting networks to limit lateral movement, and blocking untrusted traffic from reaching remote access services. They continue to discourage paying ransoms, and encourage victims to report incidents to the FBI’s Internet Crime Complaint Center or CISA.