1. Executive summary
CISA and the FBI have published an updated advisory confirming that the Medusa ransomware-as-a-service (RaaS) operation has compromised more than 500 victims as of April 2026, up from 300 in 2025. The group has transitioned to an affiliate model, compensating initial access brokers up to USD 1 million, and has demonstrated the ability to exploit newly announced vulnerabilities within 24 hours of disclosure — and in some cases up to a week before public disclosure. Medusa uses legitimate remote monitoring and management (RMM) tools for persistence and evasion, making post-compromise detection difficult in environments that do not strictly inventory and monitor RMM software. EMEA financial services firms with exposed, unpatched edge devices and permissive RMM policies are at elevated risk.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | Medusa exploits newly announced vulnerabilities within 24 hours, and in some cases before public disclosure, targeting unpatched software. | Firms must ensure vulnerability scanning and patch-management cycles can operate at the speed this threat demands; periodic testing programmes that do not account for rapid N-day exploitation are insufficient. |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | CISA confirms 500+ victims across critical infrastructure, with a specific focus on the healthcare sector and documented triple-extortion behaviour. | Threat-intelligence feeds should classify Medusa as a high-severity cyber threat for incident classification and prioritisation purposes. |
3. Technical analysis & attack chain
Medusa (MITRE G1051) emerged in 2021 as a closed ransomware operation and transitioned to a ransomware-as-a-service (RaaS) affiliate model in 2023. Affiliates are granted varying levels of access based on experience and earnings; for newer or less experienced affiliates, operations such as ransom negotiation are centrally controlled by the developers. The group recruits members on cybercriminal forums and offers initial access brokers up to USD 1 million for exclusive partnerships, with payments ranging from USD 100 to USD 1 million depending on access quality.
Confirmed attack chain
- Initial access: Medusa obtains access through access brokers and by rapidly exploiting newly announced vulnerabilities. The group has been observed using exploits within 24 hours of public disclosure and, per a Microsoft report cited by CISA, up to a week before public vulnerability disclosure. The advisory explicitly states there is no indication Medusa develops its own zero-day or N-day exploits; they obtain advanced access to exploits from unknown sources or quickly leverage newly announced exploits before victims can patch. The specific CVEs exploited are not named in the source material.
- Credential theft and lateral movement: Medusa actors use several credential-stealing tools (not named in the source) before pivoting to legitimate remote monitoring and management (RMM) software to evade detection. The FBI confirmed use of the following RMM tools: AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop. These tools are abused for persistence and remote access, blending into environments where RMM software is already permitted or unmonitored.
- Data exfiltration and extortion: Medusa exfiltrates victim data prior to encryption. The group researches target companies before attacks and bases ransom amounts on publicly announced revenue. Victims are offered lower ransoms for rapid payment. Medusa operates a leak site and removes victim information after payment, though the advisory notes there is no way to verify whether the data is truly deleted. Victims can pay USD 10,000 to extend the deadline by one day before stolen data is published.
- Observed triple-extortion indicator: The FBI documented one incident where a victim was contacted by a separate Medusa actor who claimed the negotiator had stolen the already-paid ransom and requested half the payment again to provide the "true decryptor." This may indicate a triple-extortion scheme or operational dysfunction and lack of cohesion among group members.
- Impact: The group caused widespread disruption in April 2026 by shutting down the University of Mississippi Medical Center — Mississippi's only children's hospital, only Level I trauma center, only Level IV neonatal intensive care unit, and home to the state's only organ transplant program. The group has repeatedly targeted healthcare facilities and international and U.S. municipal governments.
Operational status: Medusa has not added new victims to its leak site since April 2026, leading experts to believe the UMMC attack drew significant law enforcement attention. This is an operational pause, not a confirmed takedown.
Confidence caveat: The claim that Medusa has exploited vulnerabilities before public disclosure is attributed to a Microsoft report cited by CISA. The specific pre-disclosure CVEs and the access broker ecosystem details are single-sourced through the CISA/FBI advisory; verify before enforcement.
4. Mitigation & containment
P1 — Within 24 hours
- Audit RMM tool inventory: Enumerate all instances of AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop across the estate. Identify any unauthorised or unexpected installations. Block unapproved RMM binaries at the endpoint (EDR application control / Windows Defender Application Control) and at network egress.
- Accelerate edge-device patching: Given Medusa's demonstrated 24-hour exploitation window, ensure that newly announced CVEs affecting internet-facing services are patched within 24 hours of vendor disclosure. Prioritise CVEs affecting VPN gateways, firewalls, file-transfer appliances, and other perimeter infrastructure.
- Hunt for credential-theft tooling: The specific tools are not named in the source, but defenders should hunt for known credential-dumping and credential-harvesting utilities (e.g., LSASS access, ntds.dit extraction, browser-credential extraction) in EDR telemetry.
P2 — Within 72 hours
- RMM egress controls: If any of the listed RMM tools are legitimately used, restrict their network egress to known vendor infrastructure using firewall allow-lists. Alert on RMM processes making outbound connections to non-vendor IP ranges.
- Review external-facing attack surface: Validate that all internet-facing services are on supported versions with current patches. Medusa specifically targets software that has not been updated to include new patches.
- Validate backup integrity and isolation: Ensure backups are offline or immutable and test restoration procedures. Confirm backup infrastructure is not reachable from domain-joined endpoints.
P3 — Within 7 days
- Implement network segmentation for critical systems: Restrict lateral movement paths from user workstations to critical servers and backup infrastructure.
- Tabletop exercise: Run a ransomware tabletop scenario based on the Medusa attack chain (access broker → credential theft → RMM persistence → exfiltration → extortion) to validate incident response playbooks.
- Threat-intelligence feed integration: Subscribe to CISA/FBI advisories and ensure they are routed to the vulnerability management team for same-day triage.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, file paths) are present in the source material. The advisory describes observable behaviours and legitimate tool usage.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected installation or execution of AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, or Splashtop | EDR process telemetry, endpoint installed-software inventory | High — FBI-confirmed |
| Credential-stealing tool execution preceding RMM tool deployment | EDR process telemetry, Windows Security event logs | Medium — described by CISA; specific tools not named |
| Ransom negotiation contact from a second actor claiming the first negotiator stole payment, requesting additional payment for "true decryptor" | Incident response communications, email | Low — single incident observed by FBI |
| Rapid exploitation of newly disclosed CVEs on internet-facing services within 24 hours of advisory publication | Vulnerability scanner logs, SIEM correlation of patch status vs. exploitation alerts | Medium — attributed to Microsoft report cited by CISA |
6. Detection
Insufficient indicators to author YARA or Sigma rules. The source material names legitimate RMM tools but does not provide specific file names, paths, registry keys, mutex names, command-line arguments, or ransom-note text associated with Medusa payloads. Detection should rely on behavioural monitoring of the RMM tools listed in §5 and anomalous credential-theft activity preceding their deployment.
Threat actor context
Medusa Group · G1051
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. …
7. Sources
- The Record — "More than 200 victims of Medusa ransomware identified over the last year, CISA says" — https://therecord.media/more-than-200-medusa-ransomware-victims-in-last-year-cisa — 2026-08-18
- DataBreaches.net — "Medusa ransomware tallies hundreds of new victims, says updated advisory on group's tactics" — https://databreaches.net/2026/08/18/medusa-ransomware-tallies-hundreds-of-new-victims-says-updated-advisory-on-groups-tactics/ — 2026-08-18
8. Adverse Trace position
Medusa (MITRE G1051) represents a high-severity threat to EMEA financial services, primarily due to its demonstrated capability to exploit newly disclosed vulnerabilities within a 24-hour window and its systematic abuse of legitimate RMM tools for persistence and evasion. The group's affiliate model and access-broker compensation structure (up to USD 1 million) indicate a well-funded operation with sustainable access acquisition. The operational pause since April 2026 — likely triggered by law enforcement attention from the UMMC attack — is a temporary reduction in activity, not a permanent disruption. Firms should treat this as a window to harden, not a stand-down. Adverse Trace will monitor for Medusa leak-site resumption, new CVE exploitation reporting, and any law enforcement action. The pre-disclosure exploitation claim is single-sourced through Microsoft via CISA; we will corroborate before treating it as confirmed capability.
Published via PulseTrace — Adverse Trace threat intelligence.