The updated Medusa ransomware advisory is a reminder that threat actor tracking is most useful when it changes defensive work. In August 2026, the FBI, CISA and the Department of Health and Human Services said that Medusa actors had impacted more than 500 victims across US critical infrastructure sectors as of April 2026. BleepingComputer’s report on the update records the change from the more than 300 victims described in the March 2025 joint advisory.
The number is important, but it is not the whole story. Medusa is a ransomware-as-a-service operation that uses affiliates and initial access brokers. That structure makes the group less dependent on one intrusion style. Different operators can bring different access, tools and habits into the same extortion programme. A defender who searches only for a named payload may miss the earlier activity that matters more: an exposed service, a valid account, a remote management session or a suspicious transfer of data.
The operation first appeared in 2021, gained wider attention after its leak site activity in 2023, and adopted an affiliate model. The updated advisory says that Medusa developers typically recruit initial access brokers in criminal forums and marketplaces. It describes possible payments from 100 US dollars to 1 million US dollars for affiliates who provide access or work exclusively for the operation. That commercial model connects an organisation’s external exposure to a threat actor’s acquisition process.
Security teams can use the ransomware protection fundamentals that they already have, but they should test whether those controls work before encryption begins. The practical questions are whether exposed weaknesses are found, whether high-value accounts are protected, whether lateral movement is visible, and whether data theft would be detected before the extortion note arrives.
One of the less technical but important details in the advisory is naming. Medusa is used by several malware families and cybercrime operations. The operation described in the FBI and CISA material is not the same as MedusaLocker. It is also distinct from a Mirai-based botnet and an Android malware-as-a-service operation that have used the Medusa name. A name match is not a reliable attribution.
This is a common threat intelligence problem. A detection rule, news alert or vendor report may mention a group name without the same definition of the actor used by an incident responder. If a team merges every item containing “Medusa” into one profile, it can create false confidence about tooling, infrastructure and tactics. An accurate record should include the source, date, malware or operation label, confidence and the exact behaviour described.
Keep the naming problem close to the detection workflow. If a source says Medusa ransomware, map the item to the advisory’s behaviours and indicators. If a source says MedusaLocker, treat it as a separate research path until the evidence supports a connection. If an IP address or domain appears in more than one report, do not assume the actor is the same. Reuse can reflect a provider, a compromised host or a shared criminal service.
This discipline also improves communication with executives. Saying that “Medusa is active” is less useful than explaining that a ransomware service with a history of brokered access has affected more than 500 organisations and that the organisation still has three internet-facing services with unresolved findings. The first statement describes news. The second creates an action.
A closed operation can develop a recognisable sequence. An affiliate model creates more variation before the ransomware payload is deployed. One affiliate may use a stolen VPN credential. Another may buy access to a remote desktop gateway. A third may exploit an unpatched public-facing application. The core business outcome is the same, but the observable entry point differs.
The updated advisory says that Medusa developers recruit initial access brokers. This matters because the first person in the chain may not be the person who deploys the ransomware. Access can be obtained, tested, sold, transferred and then used by another operator. A quiet account login in January may be connected to a data theft event in March even when the later operator uses different infrastructure.
Build monitoring around the hand-off points. Review new privileged sessions, first-time remote access, VPN use from unusual locations, changes to authentication factors and dormant accounts that become active. Link the account activity to the device, source network, session duration and actions performed. A login alert without the surrounding context is easy to dismiss. A login followed by directory discovery and unusual archive creation is a stronger investigation lead.
At the asset layer, track internet-facing services that can provide a broker with a route to the network. This includes remote access gateways, exposed management panels, edge appliances, public cloud control planes and applications with known weaknesses. Dark web monitoring can add context when access claims or stolen credentials appear outside the organisation, but it should not replace internal validation. A criminal post may be false, old or unrelated to the organisation.
The aim is to shorten the distance between an access signal and a controlled response. If the organisation needs three days to identify the account owner, the broker has already created time for the affiliate. A current identity inventory, clear escalation path and pre-approved containment actions are defensive controls, not administrative extras.
The agencies identified Healthcare and Public Health, the Defence Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services among the affected critical infrastructure sectors. They also named medical, education, legal, insurance, technology and manufacturing organisations. The range is wide enough to reject a narrow assumption that only one industry type needs to prepare.
Sector matters because it changes the impact of downtime and the data available to steal. A healthcare organisation may have clinical dependencies and sensitive patient information. A manufacturer may have production systems that cannot be rebuilt from an ordinary office backup. A financial services business may have strict recovery and reporting obligations. A government service may face public trust damage even when the initial technical entry point is a standard remote service.
Map the actor’s likely objectives to business processes. Identify the systems that would create immediate operational pressure if encrypted. Identify repositories containing sensitive records, engineering designs, legal material or credentials. Identify which of those systems can be reached from a workstation, a server, a backup network or a privileged administrator account. This turns sector language into a business-specific attack path.
Do not treat critical infrastructure as a synonym for a small set of national assets. The updated advisory includes organisations across public and private sectors. A mid-sized supplier can be a valuable target because it provides access to a larger organisation or holds sensitive information that can be used for pressure. The phrase “we are not critical infrastructure” should never be the reason a team delays ransomware preparation.
Use a service map rather than a list of crown jewels. Mark dependencies, owners, authentication paths, backup locations and external connections. Then test whether the map matches what the network and identity logs show. An unrecorded relationship can become the path for lateral movement or the reason recovery takes longer than the plan says.
The joint advisory recommends mitigating known vulnerabilities, segmenting networks and blocking access from untrusted origins to remote services on internal systems. These actions sound familiar because they target repeated ransomware conditions. Their value depends on evidence. A policy that says remote services are restricted is not the same as a firewall rule that is reviewed, logged and tested from an untrusted network.
Begin with public-facing services. Build an inventory of domains, addresses, ports, products and owners. Compare it with cloud accounts, DNS records and supplier data. For every service, record the authentication method, patch state, administrative path and reason it must be public. Remove services that have no current business owner. For services that must remain exposed, use the strongest supported access controls and monitor failed and successful sessions.
Next review remote services inside the network. Restrict administrative protocols to management segments and approved jump hosts. Prevent a standard workstation from reaching every server over the same set of ports. Separate backup infrastructure from production systems. If a service cannot be segmented immediately, document the dependency and add detection for connections that should not occur under normal operations.
Patch prioritisation should combine the KEV status, external reachability, privilege, business dependency and available exploit evidence. A high severity flaw on an isolated test server may not outrank a lower scoring flaw on an exposed gateway that holds privileged access. This is the same principle described in CVE prioritisation for security teams: context determines order.
Finally test backups. Ransomware response depends on clean, reachable and recent recovery points, but the team must know whether the backup credentials and management interfaces can be reached from the same network that an attacker would control. A backup that can be deleted with a compromised domain account is not an independent recovery control.
Encryption is a late-stage signal. A team that waits for file extensions, ransom notes or endpoint alarms may have missed the access and collection phases. The useful early signals are often ordinary events that become meaningful when correlated: an account authenticates from a new location, a remote service is accessed outside a normal window, a tool enumerates hosts, archives appear in a staging directory, and a large transfer leaves the environment.
Define a small number of high-value sequences and test them. One sequence can start with a VPN login from a new geography and continue with access to a file server. Another can start with a newly created account and continue with privileged group changes. A third can start with a vulnerable internet-facing application and continue with an outbound connection from a server that normally accepts inbound traffic only.
Detection must have an owner. The SOC may alert on a suspicious session, while the identity team owns account revocation and the network team owns containment. Put the hand-off in the playbook. Include the approval path for isolating a server, disabling an account, blocking an address or forcing a password reset. An alert that has no clear next person is only a record of something the organisation noticed.
Keep threat intelligence attached to the decision. The CISA Medusa advisory contains the actor context and defensive recommendations. It is more useful when the team maps the advisory to local logs, products and attack paths. Do not copy every indicator into a blocklist and assume the work is done. Indicators age, infrastructure changes and affiliates use different tooling.
When a detection fires, preserve the evidence that explains the decision. Record the account, host, source, timestamp, action and response. This creates a better incident timeline and improves future tuning. If the event is benign, record why. If it is malicious, the first few minutes of context can be more valuable than a long report written after containment.
Medusa’s leak-site activity reflects the double-extortion model: the attacker can use stolen data to pressure a victim even when the organisation has a functioning backup. The exact data exposure will vary, but the response pattern is consistent. Identify the systems accessed, determine what was copied, preserve evidence, notify the right stakeholders and decide how to communicate with customers, regulators and partners.
Do not assume that an archive created on a compromised server is the only collection point. Attackers can copy material in stages, use cloud storage, move files through an approved service or compress data on a system that was not originally considered sensitive. Review unusual archive utilities, file reads, storage access, outbound transfers and access to repositories outside the user’s normal role.
Classification helps with speed. Before an incident, mark the data sets that would create legal, safety, competitive or trust consequences if stolen. During an incident, that classification guides the first investigation. It also helps technical teams explain why a particular server or repository needs immediate isolation while a less sensitive system can stay online for continuity.
Be careful with claims found on a leak site. A threat actor may exaggerate a victim list or publish samples from an old incident. Treat the claim as a lead. Correlate names, file structures, timestamps and known internal references with local evidence. Avoid amplifying unverified claims in public communications. The goal is to understand exposure and protect affected people, not to give the actor free distribution.
Recovery is not complete when encryption stops. Rotate credentials that may have been accessed, rebuild compromised systems from trusted media, validate the backup environment, remove persistence, review supplier access and monitor for follow-on fraud. Extortion pressure can continue after technical recovery, especially when data that contains employee, customer or partner information is involved.
The updated Medusa count should prompt a review of readiness, not a one-off awareness message. Start with the exposure window. How long does it take to find an internet-facing service that matches an advisory? How long does it take to identify its owner? How long to contain it? How long to confirm the patch or configuration change? Measure each part separately because a good mean time to patch can hide a slow discovery process.
Track identity exposure too. Count privileged accounts without phishing-resistant protection where available, dormant accounts, supplier accounts without a current owner, shared administrator accounts and credentials found in old configuration files. These are not all equally risky, but each represents a path that a broker or affiliate may be able to sell.
Test segmentation with a real path. Choose a workstation, a server and the backup network. Verify what traffic is allowed, what is blocked, what is logged and who receives the alert. If the test is performed only on a diagram, the organisation may discover during an incident that a legacy exception still connects the environments.
Run a tabletop around an access-broker scenario rather than starting with the ransom note. The exercise should begin with a suspicious VPN login or a public-facing vulnerability and force the team to decide whether to disable an account, isolate a host, protect backups and notify senior leaders. Add a second phase where a leak-site claim appears. This tests both technical response and the communication discipline needed when facts are incomplete.
Finally, keep the actor profile current without making it the centre of the programme. Medusa may change affiliates, tools and infrastructure. The durable controls are the same: a current external asset view, protected identities, restricted remote services, segmented networks, monitored data movement and tested recovery. Actor tracking tells you which controls to test first. It does not replace them.
A briefing that says “Medusa has over 500 victims” can create attention, but it does not show whether the organisation is exposed. Pair the external fact with three local facts: the number of reachable remote services, the number of privileged accounts with unresolved control gaps, and the recovery point that was last tested. This gives leadership a way to decide where to remove friction.
Explain what is known, what is suspected and what is not yet checked. If a supplier owns a public-facing gateway and has not provided patch evidence, say so. If the logs are incomplete, say so. Clear uncertainty is more useful than a confident statement that cannot survive the first incident review.
No. The figure reported in the updated advisory concerns more than 500 victims across US critical infrastructure sectors as of April 2026. It is not a complete global census. It is still a useful scale signal because it shows sustained activity across multiple industries and confirms that the operation remains relevant to defenders.
No. The names refer to separate ransomware operations. The joint advisory and the reporting around it warn that several malware families and criminal operations use the Medusa name. Keep profiles separate until specific evidence supports a connection.
Find and reduce external exposure, protect remote access accounts, restrict internal remote services, separate backups from production and test recovery. Then map the organisation’s most sensitive data and the systems that can reach it. These steps reduce the value of brokered access even when the organisation cannot operate a large threat intelligence team.
No. Use published indicators as one input to detection and hunting, but do not treat them as a complete actor signature. Affiliates can use changing infrastructure and common tools. Behaviour, exposure context and account activity often remain useful after a particular address or hash has aged out.
Defendis connects external exposure, threat intelligence and security signals so your team can see which assets and identities need attention first. Track suspicious infrastructure, leaked access and changing risk without waiting for a breach report.
