The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021.
This was revealed in a joint advisory in coordination with the Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (HHS).
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
This is an update to a joint report published in March 2025, which said the Medusa ransomware operation had impacted an estimated over 300 critical infrastructure organizations.
The three federal agencies recommended that network defenders secure their networks against the ransomware group’s attacks by mitigating security vulnerabilities to protect operating systems, software, and firmware from exploitation attempts.
Security teams are also advised to segment networks to block lateral movement after compromise and to block access from untrusted origins to remote services on internal systems.
The Medusa ransomware operation surfaced five years ago, in January 2021. However, the gang’s activity only picked up in 2023 when it launched the Medusa Blog leak site and started using stolen data as leverage to pressure victims into paying ransoms.
While Medusa emerged as a closed ransomware variant, it evolved into a Ransomware-as-a-service (RaaS) operation and adopted an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a commonly used name among malware families and cybercrime operations, including an Android malware-as-a-service (MaaS) operation discovered in 2020 (also known as TangleBot) and a Mirai-based botnet with ransomware capabilities.
Because of this, reporting on Medusa ransomware has also often been confusing, with many thinking it’s the same as the widely known MedusaLocker ransomware operation, although they’re entirely different operations.
The Medusa cybercrime operation gained media attention in March 2023 after claiming an attack on the Minneapolis Public Schools (MPS) district and sharing a video of the stolen data.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
US and South Korea warn of Gunra ransomware targeting govt agencies
FBI: Hackers target online accounts to steal nude photos
CISA: Windows Task Host flaw now exploited by ransomware gangs
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
Microsoft confirms GitHub is down worldwide
Hacker claims 3.6 million Azure account records stolen from major companies
Anthropic confirms Claude is down in major outage affecting multiple services
Certighost CVE is new. The privilege behind it isn’t. Discover where yours is hiding.
Overdue a password health-check? Audit your Active Directory for free
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Signature-based prevention fell to 50%. See what your controls still stop.
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
