InfoSecBulletin Cybersecurity for mankind
Medusa ransomware hit over 500 critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that the Medusa ransomware group hit over 500 critical infrastructure entities in the United States since June 2021.
This was announced in a combined alert from the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI).
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
The original report from March 2025 said that the Medusa ransomware affected more than 300 important organizations.
The three federal agencies said that network defenders should make their networks safe from the ransomware group’s attacks. They should fix security problems to protect operating systems, software, and firmware from being exploited.
Security teams should divide networks to prevent lateral movement after a breach and stop access from untrusted sources to remote services on internal systems.
Active since January 2021
The Medusa ransomware group appeared five years ago, in January 2021. Their activity increased in 2023 when they started the Medusa Blog leak site and used stolen data to force victims to pay ransoms.
Medusa started as a closed ransomware type, but it changed into a Ransomware-as-a-service (RaaS) business and used an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a popular name for malware groups and cybercrime activities. This includes a Mirai botnet that can do ransomware attacks and an Android malware service found in 2020, also known as TangleBot.
Many reports on Medusa ransomware have been unclear. People often mix it up with the well-known MedusaLocker ransomware, even though they are not the same.
The Medusa cybercrime group got noticed by the media in March 2023 when it said it attacked the Minneapolis Public Schools (MPS) district and posted a video of the stolen data.
