Loading story…
CISA, the FBI, and HHS issued an updated joint advisory warning that Medusa ransomware operators have compromised more than 500 organizations as of April 2026, with heavy targeting of critical infrastructure and especially healthcare and public health entities. The agencies said the group evolved from a closed operation into a ransomware-as-a-service model in 2023, using double extortion by stealing data before encrypting systems. Officials said Medusa actors can exploit newly disclosed vulnerabilities within 24 hours, and in some cases were observed abusing flaws up to a week before public disclosure.
The advisory said Medusa gains access through initial access brokers, reportedly offering up to $1 million for exclusive access, and has exploited vulnerabilities including CVE-2024-1709, CVE-2023-48788, GoAnywhere MFT flaws, and CVE-2026-1731. Once inside, operators use living-off-the-land techniques, credential dumping, stolen or vulnerable drivers, and legitimate remote monitoring and management tools to disable security controls, move laterally, steal sensitive data, and encrypt networks. Authorities also described aggressive extortion tactics such as rapid-payment discounts and paid deadline extensions, while urging organizations to patch quickly, segment networks, enforce phishing-resistant MFA, maintain offline immutable backups, and monitor for unauthorized RMM activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On Tuesday, CISA, the FBI, and HHS issued an updated joint advisory on Medusa ransomware, warning that the group is actively infiltrating enterprise networks, stealing data, disabling security tools, and encrypting systems. The bulletin included indicators of compromise and mitigation guidance, and reflected forensic findings through April 2026.
The updated advisory said Medusa had compromised more than 500 organizations as of April 2026, up from about 300 victims previously reported in 2025.
The Record reported that Medusa shut down the University of Mississippi Medical Center in April, highlighting the group's impact on the healthcare sector.
The updated 2026 warning explicitly states it revised a March 2025 advisory about Medusa ransomware activity issued by CISA and the FBI.
In February 2023, Medusa attacked Minneapolis Public Schools and demanded a $1 million ransom. After the district refused to pay, the group leaked more than 100,000 sensitive records.
Around 2023, Medusa transitioned from a closed operation to an affiliate-based ransomware-as-a-service model, with core developers supplying payloads and affiliates participating for a share of extortion revenue.
U.S. authorities said Medusa was first observed in June 2021 and initially operated as a closed ransomware group before later changing its model.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceinfosecurity-magazine.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcecybersecuritynews.com
Open sourcecontent.govdelivery.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said threat actor **Storm-1175** is running high-tempo intrusions that exploit newly disclosed and, in some cases, previously unknown vulnerabilities in internet-facing systems to steal data and deploy **Medusa ransomware** within days or even 24 hours. The financially motivated group has heavily impacted healthcare organizations and also targeted education, professional services, and finance in Australia, the United Kingdom, and the United States. Since 2023, the actor has exploited more than 16 flaws across products including **Microsoft Exchange**, **PaperCut**, **Ivanti**, **ConnectWise ScreenConnect**, **JetBrains TeamCity**, **SimpleHelp**, **CrushFTP**, **GoAnywhere MFT**, **SmarterMail**, **SAP NetWeaver**, and **BeyondTrust**, with Microsoft also observing zero-day use against SmarterMail and GoAnywhere before public disclosure. After gaining access, Storm-1175 establishes persistence with new administrator accounts, web shells, and remote management tools, then moves laterally using LOLBins, **Impacket**, **PDQ Deployer**, and Cloudflare tunnels while stealing credentials from **LSASS**, `NTDS.dit`, `SAM`, and backup systems. Microsoft said the actor tampers with Microsoft Defender settings to reduce detection, uses **Bandizip** and **Rclone** for collection and exfiltration, and deploys Medusa through PDQ Deployer or Group Policy; the group has also shown interest in Linux targets such as vulnerable **Oracle WebLogic** servers. Microsoft urged organizations to reduce exposure of web-facing assets, patch quickly, enforce MFA on approved RMM tools, restrict local administrator rights, and enable protections such as **Credential Guard**, tamper protection, and Defender XDR attack disruption features.
Aug 18, 2026
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026
**University of Mississippi Medical Center (UMMC)** is facing an extortion threat after the **Medusa** ransomware gang claimed responsibility for the February cyberattack that disrupted hospital operations and forced staff to rely on paper processes and other offline workarounds. The incident affected one of Mississippi’s most critical healthcare providers, with hospitals and emergency departments remaining open while **35 clinic locations** were closed; recovery involved assistance from the **FBI** and **Department of Homeland Security**, and full reopening was reported on March 2. Medusa later posted on its leak site that it had stolen data from UMMC and demanded **$800,000**, with a deadline of **March 20**. Reporting indicates the gang offered multiple extortion options, including paying to delete the data, buying the allegedly stolen information, or paying a smaller amount to extend the deadline. Screenshots were published as purported proof of theft, but UMMC had not confirmed that sensitive patient or enterprise data was actually exfiltrated, and the size and scope of the alleged data set remained unclear at the time of reporting.
Jun 29, 2026