Reported by 5 outlets

Timeline

1. original reporting

   Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

   cyberscoop.com · 56d ago · August 18th, 2026

   The ransomware-as-a-service group Medusa has adopted fresh tactics to gain access and added hundreds of victims in a little more than a year, according to an updated U.S. government advisory published Tuesday. The gang is relying on access brokers,compensating them anywhere from $100 to $1 million, with higher prices going to those who work exclusively with Medusa. However, most of the brokers work simultaneously for “multiple variants at the same time,” the advisory from the Cybersecurity and Infrastructure Security Agency, FBI and Health and Human Services Department states in one of the updated portions of the advisory. Tuesday’s update advisory expands upon aMarch 2025 advisory, drawing on ongoing FBI investigations.nIt includes information on the kinds of software vulnerabilities Medusa has exploited, such as Fortra GoAnywhere and BeyondTrust flaws. “Medusa actors operate opportunistically by targeting victims with unpatched software rather than focusing on specific organizations or sectors; however, the Healthcare and Public Health (HPH) Sector has been a frequent victim of Medusa operations,” according to the advisory. “Medusa actors leverage newly announced exploits within 24 hours and have been observed to use exploits up to a week before public vulnerability disclosure.’ “However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly levera

2. update from malware.news

   Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

   malware.news · 56d ago · August 18th, 2026

   The gang is relying on access brokers,compensating them anywhere from $100 to $1 million, with higher prices going to those… Source Article Link: https://databreaches.net/2026/08/18/medusa-ransomware-tallies-hundreds-of-new-victims-says-updated-advisory-on-groups-tactics/

3. update from gbhackers.com

   Medusa Ransomware Attacks 300+ Critical Infrastructure Organizations Using Double Extortion

   gbhackers.com · 55d ago · August 19th, 2026

   Medusa ransomware operators have compromised over 500 organizations across critical infrastructure sectors, according to a joint advisory issued by the FBI, CISA, and the U.S. Department of Health and Human Services (HHS) as part of their #StopRansomware initiative. An update released on August 18, 2026, provides expanded intelligence based on FBI investigations conducted as recently […] The post Medusa Ransomware Attacks 300+ Critical Infrastructure Organizations Using Double Extortion appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   CISA Warns of Medusa Ransomware-as-a-Service Attacks Over 300 Organizations

   cyberpress.org · 55d ago · August 19th, 2026

   The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) have issued a joint advisory warning that Medusa ransomware operators continue to target critical infrastructure organizations through data theft, endpoint security evasion, and network-wide encryption operations. Tracked as AA25-071A, the #StopRansomware advisory says Medusa developers and affiliates had impacted more than 300 organizations as of February 2025. Confirmed victim sectors include healthcare, education, legal services, insurance, technology, and manufacturing. Federal investigators stressed that Medusa is unrelated to the MedusaLocker ransomware family or Medusa mobile malware. CISA Warns Medusa Ransomware-as-a-Service Attacks First identified in June 2021, Medusa began as a closed ransomware operation in which a single group controlled development and intrusions. It has since evolved into a Ransomware-as-a-Service (RaaS) operation that recruits affiliates, while core developers retain control over important functions such as ransom negotiations. The group uses a double-extortion model: affiliates steal data before applying encryption, then threaten to publish or sell it via a Tor-based leak site if the victim does not pay. Victims are instructed to contact the operators within 48 hours via a Tor live chat portal or the encrypted Tox messaging platform. Medusa also advertises stolen datasets to pros

5. update from bleepingcomputer.com

   CISA: Medusa ransomware hit over 500 critical infrastructure orgs

   bleepingcomputer.com · 55d ago · August 19th, 2026

   The three federal agencies recommended that network defenders secure their networks against the ransomware group's attacks by mitigating security vulnerabilities to protect operating systems, software, and firmware from exploitation attempts. Security teams are also advised to segment networks to block lateral movement after compromise and to block access from untrusted origins to remote services on internal systems. Active since January 2021 The Medusa ransomware operation surfaced five years ago, in January 2021. Still,