More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
CISA and the FBI updated their March 2025 advisory, stating Medusa actors had hit more than 500 victims as of April 2026, up from 300 in 2025, with a focus on healthcare and critical infrastructure. The agencies say Medusa rapidly adopts newly announced exploits, sometimes using them up to a week before public vulnerability disclosure, but does not develop its own zero-days, preferring access obtained from unknown sources. The gang moved to an affiliate model in 2023, offers up to $1 million for exclusive initial access brokers, and uses credential stealers plus legitimate remote access tools including AnyDesk, Atera, ConnectWise and Splashtop. No new victims have appeared on its leak site since April, after the shutdown of the University of Mississippi Medical Center drew significant law enforcement attention.
- Medusa victims grew from 300 (2025) to more than 500 (April 2026), heavily targeting healthcare and critical infrastructure
- Group uses exploits up to a week before public disclosure but does not develop its own zero-days
- Affiliates use credential stealers and legitimate RMM tools including AnyDesk, Atera, ConnectWise and Splashtop
- Offers up to $1 million for exclusive initial access brokers; charges $10,000 per deadline-extension day
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1003 OS Credential DumpingT1219 Remote Access SoftwareT1486 Data Encrypted for Impact
- Vendors
- Microsoft
- Threat actors
- Medusa
- Organizations
- CISAFBISafeBreach
- Countries
- United States
From the original article
3 min read at therecord.media
Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang have been identified over the last year. The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.