Medusa Ransomware Passes 500 Victims: What the Updated CISA-FBI-HHS Advisory Means

A Milestone No Defender Wanted to See

Medusa is no longer an emerging threat — it is a mature, industrialized extortion business. In a joint advisory update issued in mid-August 2026, the U.S. Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation and the Department of Health and Human Services confirmed that Medusa actors have now compromised more than 500 organizations across critical infrastructure sectors. The American Hospital Association’s summary of the update put the refresh on the record on August 19, 2026, adding new detail on the group’s tactics against hospitals.

The 500-victim figure matters because of what it represents: not a single spectacular breach, but a steady, repeatable pipeline of compromises. Medusa first emerged in June 2021 as a closed operation and, according to reporting on the advisory from Cyber Security News, transitioned to a ransomware-as-a-service (RaaS) model around 2023 — core developers now lease the payload to affiliates in exchange for a share of the proceeds. That structure is precisely what lets victim counts climb into the hundreds: the developers scale the tooling while a rotating cast of affiliates does the breaking-in.

How Medusa Actually Gets In

The advisory’s most actionable content is not the victim count — it is the attack pattern. Medusa affiliates rely on two well-worn entry routes: phishing campaigns to steal credentials, and the exploitation of known, unpatched software vulnerabilities. The group has repeatedly weaponized public CVEs: Cyber Security News’ reporting on the advisory lists CVE-2024-1709, an authentication-bypass flaw in ConnectWise ScreenConnect, and CVE-2023-48788, an SQL-injection vulnerability in Fortinet’s FortiClient EMS, among the exploited vulnerabilities. Both are patchable, both are documented, and both continue to be exploited because organizations have not applied the fixes.

Speed is the differentiator. The agencies note that Medusa affiliates move to exploit newly disclosed vulnerabilities within hours — sometimes before defenders have finished reading the vendor bulletin. Once inside, operators use “living-off-the-land” techniques and abuse legitimate remote-management tools such as AnyDesk and Atera to blend into normal traffic, and in some cases deploy vulnerable or stolen kernel drivers to disable endpoint detection and response (EDR) software before encryption begins.

The Double-Extortion Playbook

Medusa runs a double-extortion scheme: affiliates exfiltrate sensitive data before encrypting systems, then threaten to publish the stolen data on a leak site if the victim does not pay. This gives the attacker two levers — restore-the-files leverage and don’t-leak-the-data leverage — and it neutralizes the single best defense against classic ransomware, which is a clean backup. A backup restores your operations; it does nothing to stop the publication of your patients’, clients’ or employees’ records.

The financial mechanics are punishing. Cyber Security News’ reporting on the advisory describes initial-access brokers being paid anywhere from $100 to $1 million for valid corporate credentials, ransom demands reaching up to $15 million, and average payouts near $260,000 — with victims typically given a 48-hour negotiation window over Tor or Tox channels. These are estimates drawn from the advisory and its coverage rather than audited totals, but the range signals a professionalized operation with a pricing model, not opportunistic vandalism. Paubox’s summary of the updated federal guidance frames the refresh specifically around the surge in healthcare targeting.

Why Healthcare Keeps Getting Hit

Hospitals are disproportionately represented among Medusa’s victims, and the reason is structural. Healthcare organizations run large fleets of legacy and specialized medical devices that are difficult to patch, operate around the clock so downtime is intolerable, and hold exactly the kind of sensitive data that makes double extortion effective. When a Medusa affiliate encrypts a hospital’s systems, the pressure to pay is measured not in dollars but in delayed surgeries and diverted ambulances.

The joint #StopRansomware: Medusa advisory (AA25-071A) published by CISA references a 2026 incident in which Medusa claimed responsibility for an attack on a Level 1 trauma center, disrupting care delivery — a reminder that ransomware against healthcare is a patient-safety issue, not merely an IT problem. Education, legal, insurance, manufacturing and technology firms round out the target list, but the healthcare focus is what drove HHS to co-author the update.

What This Means for Security Teams

The advisory reads as a checklist because the defenses against Medusa are known — they are just unevenly applied. Organizations that treat the following as operational disciplines, not one-time projects, materially shrink their exposure.

1. Patch internet-facing systems on a hours-to-days clock, not weeks

Medusa’s edge is exploiting known CVEs before defenders patch. Inventory every internet-facing service — remote-access gateways, file-transfer appliances, VPN concentrators, ScreenConnect and FortiClient EMS instances — and commit to emergency-patch SLAs measured in hours for actively exploited flaws. If you cannot patch immediately, take the service offline or put it behind additional access controls until you can.

2. Make backups offline, immutable and tested — assume exfiltration anyway

Keep at least one backup copy offline or immutable so an affiliate cannot encrypt or delete it, and test restoration on a schedule. But because Medusa steals data before encrypting, backups alone are insufficient: reduce the blast radius by minimizing the sensitive data you retain and by segmenting networks so a single compromised credential cannot reach everything.

3. Enforce phishing-resistant MFA and monitor remote-management tools

Require multi-factor authentication — ideally phishing-resistant, hardware-backed — on every remote-access and privileged account, since stolen credentials are a primary entry vector. Then treat AnyDesk, Atera and similar tools as high-signal: alert on any remote-management software installed outside your approved baseline, because Medusa abuses legitimate tools precisely to avoid tripping malware detection.

4. Pre-decide your ransom position and rehearse the response

Do not make the pay-or-don’t-pay decision under a 48-hour countdown. Agree in advance — with legal, executive and, where relevant, regulators — on your position, your notification obligations, and who has authority to act. Rehearse the incident-response runbook so that when EDR goes dark and files start encrypting, the team executes a plan instead of improvising.

The Structural Lesson

The number that should worry defenders is not 500 — it is “within hours.” Medusa’s success is built almost entirely on a timing arbitrage: the gap between when a vulnerability becomes public and when the average organization patches it. Every other tactic in the advisory, from RaaS scaling to EDR-killing kernel drivers, is amplification. Close the timing gap and you remove the group’s primary on-ramp.

For a country like Algeria, where hospitals, ministries and financial institutions are digitizing quickly, the advisory is a preview rather than a foreign bulletin. RaaS operations are geography-agnostic; an affiliate exploiting a public CVE does not check the target’s flag first. The organizations that fare best against Medusa-class threats are not the ones with the largest security budgets — they are the ones that patch fast, back up offline, and have already decided what they will do on the worst day. That discipline is available to any institution, at any budget, starting today.

Frequently Asked Questions

Sources & Further Reading

• Agencies Issue Update on Medusa Ransomware Activity — American Hospital Association
• CISA, FBI Warn Medusa Ransomware Hackers Steal Data and Encrypt Networks — Cyber Security News
• #StopRansomware: Medusa Ransomware (AA25-071A) — CISA
• Feds Update Guidance on Medusa Ransomware After Healthcare Attacks — Paubox