InfoSecBulletin Cybersecurity for mankind
Medusa ransomware hit over 500 critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that the Medusa ransomware group hit over 500 critical infrastructure entities in the United States since June 2021.
This was announced in a combined alert from the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI).
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVDÂ in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
The original report from March 2025 said that the Medusa ransomware affected more than 300 important organizations.
The three federal agencies said that network defenders should make their networks safe from the ransomware group’s attacks. They should fix security problems to protect operating systems, software, and firmware from being exploited.
Security teams should divide networks to prevent lateral movement after a breach and stop access from untrusted sources to remote services on internal systems.
Active since January 2021
The Medusa ransomware group appeared five years ago, in January 2021. Their activity increased in 2023 when they started the Medusa Blog leak site and used stolen data to force victims to pay ransoms.
Medusa started as a closed ransomware type, but it changed into a Ransomware-as-a-service (RaaS) business and used an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a popular name for malware groups and cybercrime activities. This includes a Mirai botnet that can do ransomware attacks and an Android malware service found in 2020, also known as TangleBot.
Many reports on Medusa ransomware have been unclear. People often mix it up with the well-known MedusaLocker ransomware, even though they are not the same.
The Medusa cybercrime group got noticed by the media in March 2023 when it said it attacked the Minneapolis Public Schools (MPS) district and posted a video of the stolen data.
