Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
An updated joint advisory from CISA, FBI, and HHS states Medusa ransomware has affected more than 500 organizations, spanning healthcare, defense, manufacturing, government, IT, financial services, education, insurance, and legal sectors. Since early 2023 Medusa has operated a ransomware-as-a-service affiliate model and buys access from initial access brokers for $100 to $1 million. Affiliates gain entry via phishing and unpatched internet-facing software, exploiting newly disclosed flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust within 24 hours. The group runs double extortion, giving victims 48 hours before leak-site publication, with $10,000 in cryptocurrency buying a one-day delay.
- Joint CISA/FBI/HHS advisory update covers 500+ Medusa victims since June 2021, including healthcare, defense, manufacturing, and finance.
- Medusa moved to a RaaS affiliate model in early 2023 and buys access from brokers for $100 to $1 million.
- Affiliates exploit newly disclosed flaws in ScreenConnect, Fortinet EMS, GoAnywhere, and BeyondTrust within 24 hours.
- Uses PowerShell, Mimikatz, AnyDesk; gaze.exe encrypts files with .medusa extension after stopping backup and security services.
- Double extortion: 48-hour deadline, leak-site countdown; $10,000 in crypto buys a one-day extension.
- ATT&CK
- T1566 PhishingT1190 Exploit Public-Facing ApplicationT1003.001 LSASS MemoryT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Products
- AnyDeskSimpleHelp
- Threat actors
- Medusa
From the original article
2 min read at helpnetsecurity.com
Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory. The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.