Medusa ransomware hits over 500 critical infrastructure sites, says federal advisory

Federal cybersecurity agencies have issued an updated advisory warning that the Medusa ransomware operation has compromised more than 500 critical infrastructure organizations as of April 2026, a significant increase from the 300 victims reported in early 2025. The joint alert, published on August 18, 2026, by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS), highlights the group's relentless targeting of the healthcare sector and its rapidly evolving technical capabilities.

The advisory details how Medusa, which first emerged in June 2021 as a closed operation, transitioned to a Ransomware-as-a-Service (RaaS) model around 2023. Under this structure, core developers lease ransomware payloads to recruited affiliates, who gain initial access through various means, including collaboration with initial access brokers and the exploitation of known software vulnerabilities. The agencies noted that Medusa actors have been observed weaponizing public vulnerabilities within 24 hours of disclosure, and in some cases, up to a week before a public patch is available.

Once inside a network, Medusa operators employ...