The Medusa ransomware group has compromised over 500 organizations across various critical infrastructure sectors since its emergence in June 2021, according to a joint advisory updated by the FBI, CISA, and the Department of Health and Human Services (HHS). The updated guidance, released in August 2026, incorporates findings from FBI investigations conducted through April 2026 and expands upon an initial advisory from March 2025.
Victims of Medusa ransomware span a wide array of industries, including healthcare, defense, manufacturing, government services, information technology, and financial services. Beyond these critical sectors, the group has also targeted organizations in education, insurance, and law firms.
Initially operating as a closed group where the same threat actors managed all development and campaigns, Medusa transitioned to an affiliate model by early 2023. Under this model, the group sells ransomware-as-a-service (RaaS) to affiliates, who are granted varying levels of access and trust based on their experience and profitability.
Medusa affiliates frequently acquire initial access from brokers on cybercriminal forums, with payments ranging from $100 to $1 million. These initial access brokers often work with multiple ransomware variants simultaneously, not exclusively for Medusa.
The group employs common attack vectors, primarily relying on phishing to steal credentials and exploiting unpatched software vulnerabilities to gain initial network access. Recent targets of Medusa affiliates include flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust products. The advisory notes that affiliates are quick to leverage newly disclosed exploits, often within 24 hours of public announcement, though there is no indication that Medusa develops its own zero-day vulnerabilities.
Once inside a network, Medusa actors prefer to use legitimate tools already present on the system rather than deploying custom malware. These tools include PowerShell for scripting, Mimikatz for credential theft, and remote access software such as AnyDesk and SimpleHelp. The encryption process itself is handled by a program named gaze.exe, which first disables backup and security services before encrypting files and appending a .medusa extension.
Medusa employs a double-extortion model. Victims are typically given 48 hours to respond to a ransom note. If no response is received, Medusa begins direct communication with the victim, and their stolen data is posted on a leak site accompanied by a countdown timer. An additional day can be purchased for $10,000 in cryptocurrency.
To mitigate the risk of Medusa ransomware attacks, the agencies recommend patching internet-facing systems promptly, segmenting networks to restrict lateral movement, and blocking untrusted traffic from reaching remote access services. They continue to advise against paying ransoms and encourage victims to report incidents to the FBI's Internet Crime Complaint Center or CISA.
