Medusa ransomware group attacked more than 500 victims since 2021

Three federal agencies reported Aug. 18 that the Medusa ransomware-as-a-service (RaaS) group has attacked more than 500 victims from June 2021 to at least April 2026 — an operation that relies on speed to extort victims into making hefty payments often in the hundreds of thousands.

The RaaS group targeted the medical, education, legal, insurance, technology, and manufacturing sectors, said the joint report, an update to a document originally released March 12, 2025, by the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS).

“CISA says Medusa affiliates are inside within 24 hours of a public exploit, and have been observed using exploits a week before the CVE is even disclosed,” said Denis Calderone, chief technology officer at Suzu Labs. “They are not writing those zero-days themselves, they are buying them or racing the patch cycle, and that speed advantage is baked into the business model now. It’s an ecosystem that rewards speed because whoever gets in first gets the ransom.”

First identified in June 2021, Medusa developers and affiliates use a double-extortion model in which they encrypt victim data and threaten to publicly release exfiltrated data if a ransom does not get paid.

Some notable attacks include an incident at the University of Mississippi Medical Center in February 2026, which suffered a nine-day system outage that forced the medical facility to close outpatient clinics and run paper-based operations after an attack that included an $800,000 ransom demand.

Another one was on the Minneapolis Public Schools in February 2023, where attackers demanded $1 million and later leaked more than 100,000 sensitive records on its public extortion site when the district refused to pay.

According to yesterday's joint report, Medusa actors typically recruit initial access brokers (IABs) to gain access to potential victims. They offer payments between low increments of $100 and much higher $1 million payments to IABs. Medusa actors are known to make use of common phishing techniques as a way to steal victim credentials.

The joint report also lays out the unpatched CVEs the Medusa actors tend to exploit. All of the flaws cited in the report are either maximum-severity or critical bugs with 9.8 CVSS scores:

Roman Sannikov, global research coordinator at iCounter, explained that the number worth discussing here isn't 500 victims: it's the $100 to $1 million range Medusa pays for initial access.

Sannikov said that spread reflects two different tiers of the same operation. On one end, Medusa buys opportunistically from the IAB marketplace, cheap access to smaller or less defended targets. On the other hand, the group maintains proprietary, dedicated (if possible) IABs they pay very well and keep close, brokers who work for Medusa specifically rather than shopping access around to competing ransomware crews.

“That second tier is the more dangerous one operationally, because Medusa isn't waiting on an open marketplace to surface an opportunity — they have people actively working access on their behalf,” said Sannikov. “What should alarm defenders more than the victim count is the speed. Medusa has been observed weaponizing newly disclosed vulnerabilities within hours of public disclosure, and once they're in, exfiltration moves just as fast."

Sannikov pointed out that such speed compresses the entire defender timeline: the old assumption that there's a patch cycle, days or a weekend, before real-world exploitation shows up is no longer safe to make against a group operating at this speed.

“Security teams reading this advisory should treat 'it's on the patch schedule for next sprint' as an unacceptable answer for anything internet-facing, because between Medusa's dedicated brokers and an hours-scale exploitation window, the gap between disclosure and compromise is closing faster than most patch management programs are built to handle,” said Sannikov.

Damon Small, a board member at Xcape, Inc., added that rapid exploitation of perimeter vulnerabilities by Medusa ransomware operators presents an enduring operational risk to healthcare and critical infrastructure providers, where unexpected downtime threatens essential public services.

Small said while the group occasionally weaponizes flaws shortly before or after public disclosure, its primary entry point remains well-known vulnerabilities on internet-facing software for which patches already exist. As the joint report highlights, Small said these threat actors intentionally target organizations that often lack dedicated cybersecurity teams. However, an absence of specialized security staff does not excuse neglecting fundamental IT administration, said Small.

“Virtually all targeted entities employ internal or third-party system administrators whose core capability and job responsibility includes basic software maintenance and routine patching,” said Small. “Ransomware will remain a pervasive and lucrative threat as long as the industry fails to execute basic hygiene. Security leaders and IT managers must enforce strict patching SLAs on all edge assets, mandate rigid network segmentation around sensitive workloads, and maintain immutable offline backups to resist multi-stage extortion tactics.”

Small offers three takeaways for security pros: