InfoSecBulletin Cybersecurity for mankind
Medusa ransomware hit over 500 critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that the Medusa ransomware group hit over 500 critical infrastructure entities in the United States since June 2021.
This was announced in a combined alert from the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI).
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
The original report from March 2025 said that the Medusa ransomware affected more than 300 important organizations.
The three federal agencies said that network defenders should make their networks safe from the ransomware group’s attacks. They should fix security problems to protect operating systems, software, and firmware from being exploited.
Security teams should divide networks to prevent lateral movement after a breach and stop access from untrusted sources to remote services on internal systems.
Active since January 2021
The Medusa ransomware group appeared five years ago, in January 2021. Their activity increased in 2023 when they started the Medusa Blog leak site and used stolen data to force victims to pay ransoms.
Medusa started as a closed ransomware type, but it changed into a Ransomware-as-a-service (RaaS) business and used an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a popular name for malware groups and cybercrime activities. This includes a Mirai botnet that can do ransomware attacks and an Android malware service found in 2020, also known as TangleBot.
Many reports on Medusa ransomware have been unclear. People often mix it up with the well-known MedusaLocker ransomware, even though they are not the same.
The Medusa cybercrime group got noticed by the media in March 2023 when it said it attacked the Minneapolis Public Schools (MPS) district and posted a video of the stolen data.
