Medusa Ransomware Expands Its Reach
The FBI, CISA, and the Department of Health and Human Services have issued a joint advisory revealing that Medusa ransomware has now impacted over 500 critical infrastructure organizations as of April 2026. That’s a significant jump from the 300 organizations reported in a March 2025 advisory, which covered activity through February 2025.
The updated warning, published August 18, singles out healthcare as a particularly frequent target. The advisory notes that Medusa actors have been opportunistic, going after victims with unpatched software rather than focusing on specific sectors. But the numbers suggest healthcare has borne the brunt.
Medusa first appeared in June 2021 as a closed operation, then shifted to an affiliate model by early 2023. Since then, it’s evolved into one of the more active ransomware-as-a-service (RaaS) groups around.
Exploiting Vulnerabilities at Breakneck Speed
Unpatched vulnerabilities remain Medusa’s primary entry point. What’s changed is the speed. The advisory says the group has been observed using exploits within 24 hours of public disclosure — often before victims even have a chance to patch.
In some cases, Medusa actors have leveraged exploits up to a week before the vulnerability is publicly announced. That’s a troubling timeline for defenders.
There’s no evidence Medusa develops its own zero-days. Instead, they’re fast followers, weaponizing known flaws quickly and moving on.
Nick Tausek, lead security automation architect at Swimlane, says this speed is creating real problems for security teams. “Shrinking windows put far more pressure on defenders to identify and remediate exposed systems before Medusa can take advantage. Dangerous levels of speed can turn a newly disclosed flaw into an active intrusion before many security teams have even finished assessing their exposure,” he commented.
Interactsh and Verification Tactics
The group has also adopted Interactsh dynamic URLs to verify successful exploitation. This lets them identify compromised hosts and confirm their foothold before moving deeper.
Stealthier Post-Exploitation and Lateral Movement
Medusa’s post-exploitation game has improved significantly. The advisory describes multiple PowerShell stealth techniques of increasing complexity, used to obfuscate payloads. They even delete PowerShell command history to cover their tracks.
New tools are in play for command and control (C2) and stealth. Publicly available tools like Nezha, an operations and maintenance server monitoring tool, give them backdoor visibility into compromised hosts. GSocket allows workstations on different private networks to connect and bypass firewalls.
The group also deploys legitimate remote monitoring and management (RMM) software, often selecting tools already present in the victim’s environment to avoid detection. These are used to move laterally and identify files for exfiltration.
Credential theft has gotten more aggressive. The advisory notes the use of Windows Task Manager Mimikatz to harvest credentials directly from the LSA authentication mechanism, recording plaintext passwords to a log file.
Andrew Costis, engineering manager at AttackIQ, highlighted the implications. “The group is blending legitimate remote management tools into its operations while using new credential theft methods and overriding security policies to maintain access,” he said.
“Stolen Active Directory files are especially concerning because they can be used to forge Kerberos tickets. At that point, Medusa isn’t just encrypting systems. It can potentially impersonate trusted users and move through an entire domain with far fewer obstacles.”
Exfiltration and the Double-Extortion Model
Medusa’s exfiltration playbook is well-established. They use Bandizip to create archives of stolen files and Rclone to move data to their C2 servers, obfuscating rclone.exe and related .conf files by renaming them.
Secure file transfer protocol (SFTP) is used to deliver the encryptor to victim machines. Encrypted files get a .medusa extension. The malware terminates all services, deletes shadow copies, and drops a ransom note.
This enables a double-extortion model: victims pay to restore systems and data, and to prevent stolen data from being published online. The ransom note demands contact within 48 hours. If victims don’t respond, Medusa actors often reach out directly via phone or email.
Ransom demands are posted on Medusa’s leak site, complete with direct hyperlinks to Medusa-affiliated cryptocurrency wallets.
FBI Urges Incident Response Readiness
Beyond prevention, the advisory stresses the need for effective incident response. Security teams should be ready to act when an intrusion occurs, not just before.
Recommended actions include:
- Use threat hunting to scope the intrusion, including logs left behind by threat actor tooling
- Remove C2 software like Nezha or any other remote access method used by the organization
- Remove local administrator accounts and rotate credentials for service accounts and domain administrator accounts
- Ensure the initial intrusion CVE is patched
- Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan
For organizations worried about their exposure, the advisory is a reminder that patch management alone isn’t enough. Speed matters, but so does having a plan for when defenses fail. The FBI’s latest Medusa ransomware advisory offers concrete steps, and security teams should review it closely.
If you’re in healthcare, the stakes are especially high. The sector’s reliance on legacy systems and connected medical devices makes it a prime target. Reviewing healthcare ransomware defense strategies could help close gaps before attackers find them.
And for those tracking broader trends, the rise of ransomware-as-a-service operations shows no signs of slowing. Medusa is just one example of how these groups evolve, adapt, and keep pressure on defenders.
CyberSecurity7 months ago
How To6 months ago
How To6 months ago
How To4 months ago
How To5 months ago
How To7 months ago
How To6 months ago