InfoSecBulletin Cybersecurity for mankind
Medusa ransomware hit over 500 critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that the Medusa ransomware group hit over 500 critical infrastructure entities in the United States since June 2021.
This was announced in a combined alert from the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI).
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
The original report from March 2025 said that the Medusa ransomware affected more than 300 important organizations.
The three federal agencies said that network defenders should make their networks safe from the ransomware group’s attacks. They should fix security problems to protect operating systems, software, and firmware from being exploited.
Security teams should divide networks to prevent lateral movement after a breach and stop access from untrusted sources to remote services on internal systems.
Active since January 2021
The Medusa ransomware group appeared five years ago, in January 2021. Their activity increased in 2023 when they started the Medusa Blog leak site and used stolen data to force victims to pay ransoms.
Medusa started as a closed ransomware type, but it changed into a Ransomware-as-a-service (RaaS) business and used an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a popular name for malware groups and cybercrime activities. This includes a Mirai botnet that can do ransomware attacks and an Android malware service found in 2020, also known as TangleBot.
Many reports on Medusa ransomware have been unclear. People often mix it up with the well-known MedusaLocker ransomware, even though they are not the same.
The Medusa cybercrime group got noticed by the media in March 2023 when it said it attacked the Minneapolis Public Schools (MPS) district and posted a video of the stolen data.
