Medusa ransomware has impacted over 500 critical infrastructure organizations as of April 2026, according to a new FBI advisory.
An earlier US government advisory on the ransomware-as-a-service (RaaS) operation, published in March 2025, reported that Medusa affiliates had hit over 300 critical infrastructure organizations as of February 2025.
The updated advisory, published on August 18, and jointly produced by the FBI, CISA and the Department of Health and Human Services, noted that the healthcare industry has been especially frequent target of Medusa actors.
The report also highlighted that since February 2025, the operation has expanded its techniques and tooling to significantly enhance its initial access and post-exploitation activities.
The Medusa ransomware variant was first detected in June 2021. It originally operated as a closed ransomware operation, before moving to an affiliate model in at least early 2023.
Medusa Speeds Up Vulnerability Exploitation
The US agencies noted that Medusa continues to exploit unpatched vulnerabilities as its primary means of initial access.
More recently, the group has been observed leveraging exploits within 24 hours after they have been announced, before many victims have had a chance to apply patches.
In some cases, Medusa actors have used exploits up to a week before public vulnerability disclosure, the advisory said.
Read now: China-Linked Threat Actors Weaponize New Vulnerabilities in Under a Day
The RaaS group has been described as opportunistic in nature, targeting victims with unpatched software rather than focusing on specific organizations or sectors.
There is no indication that Medusa actors develop their own zero-day or N-day vulnerabilities.
Another development in Medusa’s tactics is the use of Interactsh dynamic URLs to verify successful exploitation by identifying compromised hosts.
Nick Tausek, lead security automation architect at Swimlane, warned that Medusa’s rapid exploitation capabilities is creating significant challenges for security teams.
“Shrinking windows put far more pressure on defenders to identify and remediate exposed systems before Medusa can take advantage. Dangerous levels of speed can turn a newly disclosed flaw into an active intrusion before many security teams have even finished assessing their exposure,” he commented.
Updated Stealth and Lateral Movement Abilities
Medusa actors have also improved their post-exploitation capabilities, including hiding their presence in networks, bypassing defenses, moving laterally and accessing sensitive data from networks.
The FBI advisory said the group deploys several different PowerShell stealth techniques with increasing complexity, enabling them to obfuscate payloads. They also attempt to cover their tracks by deleting the PowerShell command line history.
Numerous new tools have been used to support command and control (C2) and stealth. These include publicly available tools like Nezha, an operations and maintenance server monitoring tool used to allow backdoor visibility to compromised hosts from the threat actor’s machine, and GSocket, which allows workstations on different private networks to connect and bypass firewalls.
Medusa also deploys a range of legitimate remote monitoring and management (RMM) software, selecting those already present in the victim’s environment to evade detection.
These tools are used to move laterally through the network and identify files for exfiltration.
Windows Task Manager Mimikatz is used to harvest credentials, including stealing them directly from the LSA authentication mechanism, which allows them to record plaintext passwords to a log file.
Andrew Costis, engineering manager at AttackIQ, said the advisory demonstrates that Medusa has significantly updated its playbook with techniques that are more difficult for security teams to counter.
“The group is blending legitimate remote management tools into its operations while using new credential theft methods and overriding security policies to maintain access,” he said.
“Stolen Active Directory files are especially concerning because they can be used to forge Kerberos tickets. At that point, Medusa isn’t just encrypting systems. It can potentially impersonate trusted users and move through an entire domain with far fewer obstacles.”
Medusa Exfiltration and Extortion Methods
Medusa actors install and use Bandizip to create archives of exfiltration files and Rclone to facilitate exfiltration of data to the Medusa C2 servers, while obfuscating rclone.exe and associated rclone.conf files by renaming the files.
Secure file transfer protocol (SFTP) is used to transfer its encryptor to victim machines. The encrypted files have a .medusa file extension, which terminates all services and deletes shadow copies before dropping a ransom note to the victim.
This approach allows Medusa to adopt a double-extortion model, demanding that victims pay both to restore their systems and data and to prevent their data being published online.
The ransom note typically demands that victims make contact within 48 hours, with Medusa actors often contacting them directly via phone or email if they have not responded to the ransom note.
Ransom demands are posted on Medusa’s leak site, with direct hyperlinks to Medusa-affiliated cryptocurrency wallets.
FBI Urges Victims to Focus on Incident Response
Alongside prevention and mitigation measures outlined in the earlier Medusa advisory, the advisory recommended that security teams develop techniques that allows them to respond effectively when an intrusion occurs. These include:
- Use threat hunting activities to scope the intrusion, including logs left behind by threat actor tooling
- Remove C2 software like Nezha or any other remote access method used by the organization
- Remove local administrator accounts and rotate credentials for service accounts and domain administrator accounts
- Ensure the initial intrusion CVE is patched
- Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan
