Medusa ransomware tops 500 critical infrastructure victims, CISA warns

August 18, 2026. The FBI, CISA and the U.S. Department of Health and Human Services (HHS) released an update to their joint #StopRansomware advisory on the Medusa ransomware. On March 12, 2025, the first version counted more than 300 victims; by April 2026, the tally passed 500 critical infrastructure organizations hit since June 2021. This is not just a number going up — it is a gang that has industrialized extortion, and the advisory spells out exactly how it gets in.

The striking part of this update is not the novelty of the techniques. It is the speed with which Medusa turns a published vulnerability into initial access.

A victim count that doubled in eighteen months

Medusa is a ransomware-as-a-service (RaaS) variant that first surfaced in June 2021. It began as a closed operation — the same actors controlled development and campaigns — before shifting to an affiliate model in early 2023. Since then, developers recruit initial access brokers (IABs) on cybercrime forums, offering between $100 and $1 million for initial access, plus the option of working for Medusa exclusively.

The business model is double extortion: the actors encrypt data and threaten to publish what they exfiltrated if the ransom goes unpaid. That second lever — public shaming through a leak site — is what accelerated the operation in 2023, after the Medusa Blog leak site went live.

The victim trajectory tells the story. February 2025: more than 300. April 2026: more than 500. The scope covers Healthcare and Public Health (the most frequent victim), the Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology and Financial Services, plus medical, education, legal, insurance, technology and manufacturing. Microsoft tracks the actor as Storm-1175 and, in an April 6, 2026 post, describes it as zeroing in on exposed web-facing assets.

One recurring confusion is worth clearing up: this Medusa is unrelated to MedusaLocker, to the TangleBot Android malware (also called Medusa), and to the Mirai botnet variant of the same name. CISA states this explicitly, because the shared name has long muddied attribution.

Initial access: four CVEs and phishing

The updated advisory lists the entry points precisely. Phishing remains the primary method for stealing credentials, but exploitation of unpatched software does the rest. Four CVEs are named:

• CVE-2024-1709 — an authentication bypass in ScreenConnect (CWE-288);
• CVE-2023-48788 — a SQL injection in Fortinet EMS;
• CVE-2025-10035 — deserialization of untrusted data in Fortra GoAnywhere (added in this update);
• CVE-2026-1731 — an OS command injection in BeyondTrust (added in this update).

The behavior around flaws is the most alarming part. Medusa exploits vulnerabilities less than 24 hours after public disclosure, and has been observed using exploits up to a week before official disclosure. The FBI notes there is no indication the actors develop their own zero-days: they obtain early access to exploits from unknown sources, or capitalize on the window between announcement and patch.

To confirm an exploit worked, the actors use Interactsh, an open-source out-of-band server, through the oast[.]site, oast[.]pro and oast[.]fun domains. Each HTTP request encodes the compromised host’s name in a subdomain; the actor simply checks the server’s log to confirm execution. It is clean, loud to anyone monitoring outbound DNS, and still brutally effective.

Stealth as a doctrine

Once inside, Medusa applies a living off the land (LOTL) doctrine: blend into legitimate tooling. Initial enumeration uses Advanced IP Scanner and SoftPerfect Network Scanner, followed by sweeping a list of ports — 21, 22, 23, 80, 115, 443, 1433, 3050, 3128, 3306, 3389 — from FTP and SSH through SQL, Firebird and RDP.

Execution relies on PowerShell and cmd.exe, with WMI for querying the system. File ingress uses certutil, the legitimate PKI utility, to dodge detection. LSASS credentials are dumped through a Minidump of comsvcs.dll, and PowerShell history is wiped to cover tracks.

The PowerShell obfuscation escalates across FBI investigations: base64-encoded commands, DownloadFile strings sliced and reassembled by concatenation, and finally gzip payloads decompressed in memory through a scriptblock — a template identical to the public powerfun.ps1 stager.

Three details make Medusa especially painful to defend. First, the use of signed or vulnerable drivers to kill EDR tools (a bring your own vulnerable driver, BYOVD technique). Second, staging the Rclone exfiltration tool inside folders excluded by Windows Defender. Third, a command-and-control arsenal that repurposes legitimate tools: Ligolo-ng for reverse tunnels, Cloudflared to expose services, and Nezha, an open-source monitoring agent, as a quiet backdoor.

Extortion: encrypt, exfiltrate, publish

Medusa runs double extortion end to end. Exfiltration precedes encryption and rides on Rclone, configured to copy sensitive documents to actor-controlled cloud storage. FBI-observed commands target .docx, .pdf, .xlsx, .csv and archives, using 30 parallel transfer streams and a 500 MB per-file cap. The actors even stage the tool inside a folder excluded from Windows Defender to stay hidden.

The public side is just as methodical. Since 2023, the Medusa Blog leak site has served as leverage: victims who refuse to pay see their data published. The gang made its name in March 2023 by claiming the Minneapolis Public Schools attack and leaking a video of the stolen data — a signal aimed as much at other targets as at the victim.

The updated advisory also stresses the sectors hit hardest: alongside Healthcare and Public Health, victims span the Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology and Financial Services. This breadth matters because it changes the patch calculus — a single unpatched edge device in a hospital’s supply chain is enough to justify Medusa’s attention.

CISA closes with a pointed recommendation: validate security controls. Test detection of Medusa’s markers — Rclone exfiltration, Interactsh callbacks, vulnerable drivers killing EDR — rather than assuming the defenses work. An organization that has never tested detection of those three markers does not know whether it would see the intrusion coming.

For defenders, the industrial speed cuts both ways. Medusa’s markers are high-signal: outbound DNS to Interactsh domains, Rclone staging in Defender-excluded folders, and signed-driver tampering against EDR. Tuning detections on those three behaviors is the fastest way to catch this gang before the encryption stage begins.

Verdict

Medusa is not the most sophisticated ransomware today, but it has become one of the most industrialized. Its edge is not technical — it is conversion speed: a CVE published in the morning becomes initial access by the afternoon, encryption and a leak site a few days later.

CISA’s recommendations come down to three actions, none optional. First, patch operating systems, software and firmware within a risk-informed window — the four CVEs above must be closed if you run ScreenConnect, Fortinet EMS, Fortra GoAnywhere or BeyondTrust. Second, segment networks to stop lateral movement from the infected machine. Third, filter traffic by blocking untrusted origins from reaching remote services on internal systems.

If your estate exposes remote-access services to the internet and your patching lags CVE announcements by more than 24 hours, you are precisely the target Medusa converts best. The decision threshold is simple: close the 24-hour window, or accept a lottery with a gang that never sleeps.

References

• CISA, FBI, HHS, “#StopRansomware: Medusa Ransomware” (AA25-071A), updated August 18, 2026.
• BleepingComputer, “CISA: Medusa ransomware hit over 500 critical infrastructure orgs”, August 19, 2026.
• Microsoft, “Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations”, April 6, 2026.
• The Record, “More than 200 victims of Medusa ransomware identified over the last year, CISA says”, August 18, 2026.