Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics
CISA, FBI, and HHS updated their Medusa ransomware advisory, reporting over 500 victims and detailing the gang's access-broker and exploit tactics.
A joint advisory update from CISA, the FBI, and HHS expands the March 2025 Medusa guidance, drawing on a year of FBI investigations. The ransomware-as-a-service group's known victim tally grew from more than 300 to more than 500 between March 2025 and April 2026, with the Healthcare and Public Health sector frequently hit. Medusa pays access brokers $100 to $1 million, has exploited flaws such as Fortra GoAnywhere and BeyondTrust vulnerabilities, and leverages newly announced exploits within 24 hours, sometimes a week before public disclosure. The group uses living-off-the-land techniques, remote monitoring and management software, and RDP for lateral movement, and has been linked to actors including Microsoft-tracked Storm-1175 and North Korean hackers targeting healthcare.
- Victim tally rose from 300+ to 500+ between March 2025 and April 2026
- Access brokers are paid $100 to $1 million; most serve multiple ransomware variants
- Medusa exploits Fortra GoAnywhere and BeyondTrust flaws, using new exploits within 24 hours
- Uses living-off-the-land techniques, RMM software, and RDP for lateral movement
- Healthcare and Public Health sector has been a frequent victim
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1021.001 Remote Desktop ProtocolT1219 Remote Access SoftwareT1486 Data Encrypted for Impact
- Vendors
- FortraBeyondTrust
- Products
- GoAnywhere
- Threat actors
- MedusaStorm-1175
- Organizations
- CISAFBIU.S. Department of Health and Human Services
- Countries
- United States
From the original article
3 min read at cyberscoop.com
The updated warning from the FBI, CISA and HHS draws on a year’s worth of investigations to detail how the group gains initial access and what it does afterward.
By @timstarks · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.