Medusa ransomware breaches more than 500 organisations

Medusa ransomware operators have compromised more than 500 organisations across critical infrastructure sectors, prompting US cyber authorities to warn that the group is exploiting vulnerabilities faster and using increasingly aggressive methods to penetrate networks and extort victims.

An updated joint cybersecurity advisory from the Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency and Department of Health and Human Services said the tally had exceeded 500 by April 2026. That represents a sharp increase from more than 300 victims identified by February 2025 and reflects the expansion of Medusa’s ransomware-as-a-service operation since it emerged in June 2021.

The affected sectors include healthcare and public health, the defence industrial base, critical manufacturing, government services and facilities, information technology and financial services. Organisations in education, legal services, insurance and technology have also been targeted. Healthcare has become a particularly prominent focus because disruption can immediately affect clinical services while stolen medical information creates substantial leverage for extortion.

Medusa’s expanding reach has been accompanied by a significant acceleration in its attack methods. Investigations found that operators can exploit newly disclosed security flaws within 24 hours of details becoming public. Attackers have also been observed exploiting vulnerabilities as much as a week before public disclosure, sharply narrowing the window available to defenders for deploying patches. Authorities have found no evidence that Medusa itself develops zero-day vulnerabilities, suggesting operators obtain exploit information from other sources or move quickly when new weaknesses become known.

The group began as a relatively closed ransomware operation before adopting an affiliate model around 2023. Developers now provide ransomware infrastructure to outside operators while retaining control over parts of the criminal enterprise, including some ransom negotiations. Less experienced affiliates may receive greater operational support from the core group, allowing Medusa to expand its capacity without relying entirely on a fixed team of attackers.

Initial access brokers have become an important component of that structure. Medusa has advertised payments ranging from about $100 to as much as $1 million for access to compromised organisations, with the highest rewards offered to brokers willing to work exclusively for the group. Buying established access allows ransomware operators to bypass some of the most difficult stages of intrusion and move directly towards privilege escalation, data theft and encryption.

Once inside a network, Medusa actors use credential-stealing tools, legitimate remote monitoring applications and techniques that rely on software already present within the victim’s environment. Remote-access products observed during attacks include AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop. Using legitimate administration tools can make malicious activity harder to distinguish from routine system management.

The operation relies heavily on double extortion. Attackers steal information before encrypting systems, then threaten to publish or sell the material if payment is refused. Medusa’s leak site has displayed victims alongside countdown timers, ransom demands and cryptocurrency payment information. Victims have also been offered an additional day before publication of stolen data for a payment of $10,000.

Investigators have identified signs that the pressure can extend further. In one case, a victim that had already paid was contacted by another Medusa actor who claimed the original negotiator had stolen the payment and demanded another payment for the genuine decryptor. The episode raised the possibility of triple extortion, although internal disputes or poor coordination within the ransomware network could also explain the demand.

Ransom demands are sometimes tailored to a target’s publicly available financial information, while faster payment can attract a reduced demand. Authorities say removing a victim from Medusa’s leak site after payment provides no assurance that stolen information has actually been destroyed.

The risk became particularly visible after an attack on the University of Mississippi Medical Center disrupted operations at a healthcare system that includes Mississippi’s only children’s hospital, Level I trauma centre and Level IV neonatal intensive care unit. The incident forced clinics to close temporarily and medical staff to rely on manual processes while systems were restored.