The Medusa ransomware-as-a-service (RaaS) operation has impacted over 500 critical infrastructure organizations as of April 2026, according to a recent advisory issued by the FBI, CISA, and the Department of Health and Human Services. This marks a significant increase from an earlier US government advisory in March 2025, which reported over 300 critical infrastructure organizations affected by February 2025. The healthcare industry has been particularly targeted by Medusa actors.
The Medusa ransomware variant, first identified in June 2021, initially operated as a closed ransomware group before transitioning to an affiliate model in early 2023. Since February 2025, the group has expanded its techniques and tooling, enhancing its initial access and post-exploitation capabilities.
Medusa continues to primarily gain initial access by exploiting unpatched vulnerabilities. The group has been observed leveraging exploits within 24 hours of public disclosure, and in some instances, up to a week before a vulnerability is publicly announced. The RaaS group is described as opportunistic, targeting organizations with unpatched software rather than specific sectors, and there is no indication that Medusa actors develop their own zero-day or N-day vulnerabilities. A new tactic involves the use of Interactsh dynamic URLs to confirm successful exploitation of compromised hosts.
Post-exploitation, Medusa actors have improved their ability to evade detection, bypass defenses, move laterally within networks, and access sensitive data. They deploy increasingly complex PowerShell stealth techniques to obfuscate payloads and delete PowerShell command line history to cover their tracks.
New tools supporting command and control (C2) and stealth include publicly available utilities like Nezha, an operations and maintenance server monitoring tool that provides backdoor visibility to compromised hosts, and GSocket, which enables workstations on different private networks to connect and bypass firewalls. Medusa also utilizes legitimate remote monitoring and management (RMM) software already present in the victim’s environment to move laterally and identify files for exfiltration, thereby evading detection.
For credential harvesting, Medusa actors use Mimikatz, including directly stealing credentials from the Local Security Authority (LSA) authentication mechanism and recording plaintext passwords to a log file. Stolen Active Directory files are particularly concerning as they can be used to forge Kerberos tickets, allowing the threat actors to impersonate trusted users and move through an entire domain with fewer obstacles.
For data exfiltration, Medusa actors install and use Bandizip to archive files and Rclone to transfer data to their C2 servers. They obfuscate rclone.exe and associated rclone.conf files by renaming them. Secure File Transfer Protocol (SFTP) is used to transfer the encryptor to victim machines. Encrypted files are marked with a .medusa file extension.
The ransomware operation employs a double-extortion model. Before encryption, all services are terminated, and shadow copies are deleted. A ransom note is then dropped, typically demanding contact within 48 hours. If victims do not respond, Medusa actors often contact them directly via phone or email. Ransom demands are posted on Medusa’s leak site, with direct hyperlinks to Medusa-affiliated cryptocurrency wallets.
The advisory recommends that security teams focus on incident response in addition to prevention and mitigation. Key response actions include conducting threat hunting to scope the intrusion, removing C2 software and other remote access methods, removing local administrator accounts, rotating credentials for service accounts and domain administrator accounts, patching the initial intrusion CVE, and utilizing CISA’s Eviction Strategies Tool to develop countermeasures for a systematic eviction plan.
