← News
/DISPATCH · 2026-08-19

CISA Updates Medusa Ransomware Advisory: Victims Exceed 500, Healthcare Remains Primary Target

CISA, FBI, and HHS jointly updated the Medusa ransomware #StopRansomware advisory on 18 August. Victim count rose from 300 in March 2025 to 500+ by April 2026, more than 200 new cases. Medusa weaponizes CVEs within 24 hours of disclosure. Initial access brokers quoted up to $1 million.

CISA, FBI, and the Department of Health and Human Services (HHS) jointly updated the #StopRansomware Medusa ransomware advisory on 18 August 2026. More than 200 additional victims have been recorded since the March 2025 original, bringing Medusa's cumulative total past 500 organizations. The advisory states Medusa actors are proficient with initial access brokers, living-off-the-land, RDP, and legitimate remote-monitoring software. Healthcare and Public Health (HPH) remains the most frequently targeted sector. Some high-value infrastructure operators face simultaneous harassment from multiple Medusa branches.

Incident Overview

Medusa ransomware-as-a-service (RaaS) first appeared in 2021 and shifted to an affiliate model in 2023, recruiting by experience and contribution. Less experienced affiliates hand ransom negotiation to the Medusa core team. Victim count was ~300 in March 2025 and 500+ by April 2026—a steady expansion rate over 13 months. CISA / FBI found some victims, after paying, were contacted by different Medusa members claiming the prior ransom was intercepted by a "middleman" and demanding another 50% of the original amount for the "real" decryptor. That is either RaaS governance failure or deliberate triple extortion. IR must add contract and legal constraints at that stage.

Technical Details

Impact Assessment

Medusa's representative healthcare incident is the April 2026 outage at University of Mississippi Medical Center (UMMC)—Mississippi's only children's hospital, Level I trauma center, and Level IV NICU, and host of the state's only organ-transplant program. Impact on life-line services confirms HPH's place on Medusa's priority list. Symantec and Carbon Black have recorded North Korea-nexus threat actors using Medusa as a ransomware tool against Western healthcare, further blurring APT vs. financially motivated crime. The advisory also confirms that in the past 12 months a few weaponized vulnerabilities reached Medusa a week before public advisory, implying 0day broker markets are more mature than previously estimated. Newly disclosed critical CVEs must be treated on a 48-hour weaponization window, not a monthly patch cycle.

Remediation

References