CISA: Medusa Ransomware Has Hit Over 500 Critical Infrastructure Orgs

CISA, in coordination with the FBI and HHS, published an updated joint advisory stating that Medusa ransomware actors have impacted more than 500 victims across U.S. critical infrastructure sectors as of April 2026. The agencies named Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services as the hardest-hit categories, alongside victims in the medical, education, legal, insurance, technology, and manufacturing industries.

This is an update to a prior joint report from March 2025, which had put Medusa's confirmed toll at over 300 critical infrastructure organizations. The roughly 60% jump in reported victims over about a year signals that the group's affiliate network has kept recruiting and operating largely unchecked, according to the advisory.

Medusa ransomware first surfaced in January 2021, according to the advisory, but its activity did not accelerate until 2023, when the group launched its Medusa Blog leak site and began using stolen data as extortion leverage. The operation gained wider media attention in March 2023 after claiming an attack on the Minneapolis Public Schools district and publishing a video of stolen data, per BleepingComputer's reporting.

Medusa began as a closed ransomware variant fully controlled by its developers, then evolved into a ransomware-as-a-service model with an affiliate program. The advisory states that Medusa developers recruit initial access brokers on cybercriminal forums and marketplaces, offering them between $100 and $1 million for gaining entry into victim networks, with an option to work exclusively for Medusa.

According to CPO Magazine's summary of the advisory, Medusa opportunistically targets organizations with unpatched vulnerabilities rather than picking specific victims, and the group reportedly moves fast to exploit newly disclosed flaws, in some cases before patches become available. The advisory lists updated tactics, techniques and procedures along with indicators of compromise for defenders.

• Uses Interactsh URLs to confirm successful exploitation attempts.
• Applies PowerShell obfuscation and deletes command history to hide activity.
• Hides payloads in folders excluded from active Windows Defender scanning.
• Uses Ligolo-ng for tunneling and pivoting between compromised networks and attacker infrastructure.
• Uses Mimikatz to harvest credentials after disabling security tools, plus legitimate remote access tools such as AnyDesk, Atera, ConnectWise and SimpleHelp.

The advisory identifies Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services as the primary sectors hit, with additional victims in medical, education, legal, insurance, technology and manufacturing organizations. Security researcher John Strand, owner of Black Hills Information Security, told CPO Magazine that ransomware groups' continued focus on healthcare and critical infrastructure creates pressure that extends beyond the direct financial impact on any single victim organization.

Because Medusa is a common name in the malware world, the advisory also flags a risk of confusion: separate operations named Medusa exist as a Mirai-based botnet with ransomware features and as an Android malware-as-a-service tool also tracked as TangleBot. Reporting on Medusa ransomware has also been mixed up at times with the unrelated MedusaLocker operation, according to BleepingComputer.

CISA, the FBI and HHS recommend that network defenders mitigate known security vulnerabilities across operating systems, software and firmware to close off the exploitation paths Medusa relies on for initial access. The agencies also advise segmenting networks to limit lateral movement after any single system is compromised.

• Patch known vulnerabilities promptly, since Medusa affiliates opportunistically target unpatched systems.
• Segment networks to block lateral movement following an initial compromise.
• Block access from untrusted origins to remote services exposed on internal systems.
• Review the advisory's listed indicators of compromise and TTPs for threat hunting.

The jump from over 300 to over 500 reported critical infrastructure victims in roughly a year shows Medusa's affiliate-based business model is still attracting initial access brokers willing to sell entry into corporate and government networks. Because CISA counts victims across sectors that include hospitals, financial institutions and defense contractors, each new intrusion carries potential consequences well beyond the breached organization itself, from disrupted patient care to compromised sensitive data.

The advisory's emphasis on fast exploitation of newly disclosed vulnerabilities, sometimes ahead of available patches, adds pressure on IT and security teams already working through routine patch cycles. MSPs and internal IT teams managing critical infrastructure clients should treat the updated victim count as a signal to revisit patch prioritization and remote-access exposure rather than a one-time news item.