InfoSecBulletin Cybersecurity for mankind
Medusa ransomware hit over 500 critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that the Medusa ransomware group hit over 500 critical infrastructure entities in the United States since June 2021.
This was announced in a combined alert from the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI).
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
“As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services,” they said.
“Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries.”
The original report from March 2025 said that the Medusa ransomware affected more than 300 important organizations.
The three federal agencies said that network defenders should make their networks safe from the ransomware group’s attacks. They should fix security problems to protect operating systems, software, and firmware from being exploited.
Security teams should divide networks to prevent lateral movement after a breach and stop access from untrusted sources to remote services on internal systems.
Active since January 2021
The Medusa ransomware group appeared five years ago, in January 2021. Their activity increased in 2023 when they started the Medusa Blog leak site and used stolen data to force victims to pay ransoms.
Medusa started as a closed ransomware type, but it changed into a Ransomware-as-a-service (RaaS) business and used an affiliate model.
“Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims,” the advisory says. “Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa.”
Medusa is a popular name for malware groups and cybercrime activities. This includes a Mirai botnet that can do ransomware attacks and an Android malware service found in 2020, also known as TangleBot.
Many reports on Medusa ransomware have been unclear. People often mix it up with the well-known MedusaLocker ransomware, even though they are not the same.
The Medusa cybercrime group got noticed by the media in March 2023 when it said it attacked the Minneapolis Public Schools (MPS) district and posted a video of the stolen data.
