U.S. Advisory Says Medusa Ransomware Has Surpassed 500 Victims
Summary
An updated U.S. government advisory says Medusa has surpassed 500 victims and describes its use of access brokers, rapid exploitation of newly disclosed flaws, and legitimate tools to evade detection.
Key points
- An updated CISA, FBI and HHS advisory says Medusa’s victim tally rose from more than 300 in March 2025 to more than 500 by April.
- The advisory says Medusa uses access brokers, offering payments from $100 to $1 million, with higher rewards for exclusive access.
- Medusa has exploited flaws including those affecting Fortra GoAnywhere and BeyondTrust products, sometimes within 24 hours of public announcement.
- The advisory says Medusa has frequently targeted the Healthcare and Public Health sector, despite operating opportunistically rather than focusing on specific sectors.
- Medusa actors use legitimate tools and living-off-the-land techniques, as well as remote access software and services, for activities including lateral movement and ransomware deployment.
Article Details
- Event Type
- Updated U.S. government advisory on Medusa ransomware tactics and victim growth
- Impact
- The advisory reports that Medusa exceeded 500 victims by April 2026, up from more than 300 in March 2025, and identifies the Healthcare and Public Health sector as a frequent victim. It says the group uses access brokers, rapidly exploits newly announced software vulnerabilities, and relies on legitimate tools and remote-access methods to support intrusion activity.
MITRE ATT&CK
Threat Actors
MedusaThe advisory describes Medusa as a ransomware-as-a-service group that uses access brokers and exploits software vulnerabilities; it reports more than 500 victims and frequent targeting of the Healthcare and Public Health sector.Storm-1175Microsoft dubbed a group Storm-1175 and reported that it used Medusa ransomware in speedy operations.
Malware
Vendors
BeyondTrustMedusa ransomware-as-a-service is expanding quickly by paying access brokers and exploiting newly disclosed software flaws, including Fortra GoAnywhere and BeyondTrust vulnerabilities.FortraMedusa ransomware-as-a-service is expanding quickly by paying access brokers and exploiting newly disclosed software flaws, including Fortra GoAnywhere and BeyondTrust vulnerabilities.