The Medusa ransomware-as-a-service group has expanded its victim count to over 500 organizations, an increase of more than 200 since March 2025, according to an updated advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Health and Human Services (HHS). The group, first identified in 2021, has also refined its tactics for initial access and post-compromise activities.
The updated advisory, published on Tuesday, August 18, 2026, draws on ongoing FBI investigations and expands upon a previous advisory from March 2025. It details that Medusa actors primarily gain initial access through the use of access brokers, who are compensated between $100 and $1 million. While some brokers work exclusively with Medusa for higher payouts, most work simultaneously for multiple ransomware variants.
Medusa operates opportunistically, targeting organizations with unpatched software rather than focusing on specific sectors. However, the Healthcare and Public Health (HPH) Sector has been a frequent victim. The group is known to exploit newly announced vulnerabilities rapidly, sometimes within 24 hours of public disclosure, and has even been observed leveraging exploits up to a week before public vulnerability disclosure.
Confirmed vulnerabilities exploited by Medusa include flaws in Fortra GoAnywhere and BeyondTrust products. There is no indication that Medusa actors develop their own zero-day or N-day exploits; instead, they either obtain advanced access to exploits from undisclosed sources or quickly leverage publicly announced exploits before potential victims can apply patches.
Once inside a network, Medusa actors employ legitimate tools and "living off the land" techniques to evade detection. They leverage remote monitoring and management software, as well as remote access services like Remote Desktop Protocol (RDP), for lateral movement within the compromised network. Common utilities and tools are then used for credential access, data exfiltration, and the eventual deployment of ransomware.
Earlier this year, Microsoft documented a group it tracks as Storm-1175, which utilizes Medusa ransomware in rapid operations. Additionally, Symantec and Carbon Black have reported on North Korean threat actors leveraging Medusa to target the healthcare sector.
