Microsoft Says Medusa Exploits Vulnerabilities Before Public Disclosure
Summary
Microsoft says Medusa exploits vulnerabilities before public disclosure and can move from initial access to data exfiltration and ransomware deployment within 24 hours. The article cites attacks involving SmarterMail and GoAnywhere vulnerabilities.
Key points
- Microsoft reports that Medusa has exploited vulnerabilities before public disclosure, including CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere Managed File Transfer.
- In multiple incidents, Medusa reportedly progressed from initial access to data exfiltration and ransomware deployment within 24 hours; incidents typically lasted five to six days.
- The group targets vulnerable web-facing systems during the period between vulnerability disclosure and widespread patch adoption.
- Responders have observed operators creating user accounts to preserve access and using legitimate remote management tools, including ConnectWise ScreenConnect, AnyDesk, and SimpleHelp.
- Microsoft says recent intrusions affected healthcare, education, professional services, and finance organizations in Australia, the United Kingdom, and the United States.
- CISA previously confirmed that both cited vulnerabilities have been used in ransomware attacks.
Article Details
- Event Type
- Medusa ransomware activity exploiting newly discovered vulnerabilities before public disclosure
- Impact
- Microsoft reports that Medusa intrusions can progress from initial access to data exfiltration and ransomware deployment within 24 hours. Recent incidents reportedly affected the University of Mississippi Medical Center and Passaic County; the hospital reopened on March 2 with help from the FBI and Department of Homeland Security. Medusa claimed responsibility for the attacks.
MITRE ATT&CK
T1136.001 · Local AccountIncident responders have observed Medusa hackers create new user accounts to preserve access.T1190 · Exploit Public-Facing ApplicationMedusa actors reportedly exploit vulnerabilities in web-facing systems for initial access.T1219 · Remote Access ToolsMedusa incidents reportedly rely on legitimate remote management tools, including ConnectWise ScreenConnect, AnyDesk, and SimpleHelp.T1486 · Data Encrypted for ImpactMicrosoft reports that Medusa attacks can progress to ransomware deployment and encryption.
CVE
CVE-2025-10035Fortra · GoAnywhere MFTRecent victims include the University of Mississippi Medical Center and Passaic County, with CVE-2026-23760 and CVE-2025-10035 observed in attacks.CVE-2026-23760SmarterTools · SmarterMailRecent victims include the University of Mississippi Medical Center and Passaic County, with CVE-2026-23760 and CVE-2025-10035 observed in attacks.
Threat Actors
LazarusSymantec said it observed members of Lazarus deploying Medusa ransomware; this is a reported attribution.MedusaMicrosoft reports that the Medusa ransomware operation exploits newly discovered vulnerabilities and has targeted web-facing systems. The group claimed responsibility for attacks on Passaic County and the University of Mississippi Medical Center.
Malware
Products
AnyDeskOperators create persistent accounts and use remote management tools like ConnectWise ScreenConnect, AnyDesk, and SimpleHelp.ConnectWise ScreenConnectOperators create persistent accounts and use remote management tools like ConnectWise ScreenConnect, AnyDesk, and SimpleHelp.GoAnywhere Managed File Transferblog highlights two recent bugs — CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere Managed File Transfer — as examples of Medusa actors exploiting vulnerabilities one week before public disclosure.SimpleHelpOperators create persistent accounts and use remote management tools like ConnectWise ScreenConnect, AnyDesk, and SimpleHelp.SmarterMailThe Microsoft blog highlights two recent bugs — CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere Managed File Transfer — as examples of Medusa actors exploiting vulnerabilities one week before public
Countries
Australiaorganizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained.RussiaExperts believe the Medusa operation is based in Russia due to its avoidance of targets in the Commonwealth of Independent States, its Russian-language forum activity and the use of Cyrillic script in operational tools.United Kingdomas well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained.United Statesthose in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained.
Industries
Educationsuccessful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoftfinanceimpacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained.Healthcareidentifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors inProfessional Servicesrecent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained.