Medusa passed 500 victims, and the agencies say exploits get used within a day

FBI, CISA and HHS updated advisory AA25-071A on August 18, and the Medusa ransomware count now stands above 500 victims across critical infrastructure sectors as of April 2026. Healthcare and public health remains on the short list of most-hit sectors, alongside manufacturing, education, insurance, legal and technology. The group has operated since June 2021.

The initial access section reads like a patch backlog. Affiliates exploit CVE-2024-1709, the ScreenConnect authentication bypass; CVE-2023-48788, a SQL injection in Fortinet FortiClient EMS; CVE-2025-10035, a deserialization flaw in Fortra GoAnywhere MFT; and CVE-2026-1731, a pre-authentication command injection in BeyondTrust Remote Support rated CVSS 9.8. The agencies note the operators pick up newly published exploits within 24 hours of release.

The group also buys its way in. The advisory describes payments of $100 to $1 million to initial access brokers, followed by quiet movement with PowerShell, Mimikatz and legitimate remote tools such as AnyDesk and SimpleHelp. The encryptor, gaze.exe, appends the .medusa extension to what it locks. Victims land on a leak site with a countdown timer, a 48-hour window to respond, and a $10,000 daily fee in cryptocurrency to push the clock back.

Medusa has run as a ransomware-as-a-service operation since 2023, selling the playbook to affiliates rather than running every intrusion itself. The sector list touches device manufacturers from two directions. Manufacturing appears among the victim sectors in its own right, in a year when Stryker, Medtronic, Abbott, Cook Medical and Baylor Genetics have all disclosed corporate intrusions. The healthcare targeting lands on the hospitals that run manufacturers' devices, where an encrypted network stalls imaging, pharmacy and lab operations even when no device is touched.

The four named CVEs sit in remote support, endpoint management and managed file transfer products, the same categories manufacturers depend on to service devices in the field. A ScreenConnect or BeyondTrust box operated by a field service team is part of the device attack surface, whether or not it appears in any SBOM.

The mitigation list is familiar: patch known exploited vulnerabilities first, require phishing-resistant multifactor authentication, segment networks, keep offline backups, and investigate remote access tools nobody installed on purpose. The agencies call timely patching one of the most efficient and cost-effective defenses. Medusa's 24-hour exploit adoption is what sets the deadline.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Close the four named CVEs first if any remain open, starting with CVE-2026-1731 in BeyondTrust Remote Support, which sits in CISA's Known Exploited Vulnerabilities catalog. Assume any published exploit for perimeter, remote access or file transfer software will be tried against you within a day. Require phishing-resistant multifactor authentication, keep offline tested backups, and audit for remote access tools such as AnyDesk and SimpleHelp that your own teams did not deploy.

Patch the four named CVEs. Verify current versions of ConnectWise ScreenConnect, Fortinet FortiClient EMS, Fortra GoAnywhere MFT and BeyondTrust Remote Support against CVE-2024-1709, CVE-2023-48788, CVE-2025-10035 and CVE-2026-1731. Treat any unpatched instance as an incident lead, not a backlog item.
Hunt for tools that do not belong. Sweep for unexpected AnyDesk or SimpleHelp installs, Mimikatz artifacts and unusual PowerShell activity. Medusa moves with legitimate software, so an allowlist of sanctioned remote tools makes the outliers visible.
Segment service infrastructure from device networks. Remote support and file transfer systems used for field service should have no direct path into production or device segments. One compromised support box should not reach the plant floor or a hospital fleet.
Rehearse the 48-hour decision. The leak site countdown starts fast. Decide in advance who owns the ransom decision, when counsel and insurers join, and what notification duties trigger, so the timer burns on execution rather than on finding the right people.

For Device ManufacturersFix the class in the product

Device makers close this class at the source, not on the ward. The full engineering remediation, down to code, firmware, and hardware changes, sits in the sponsor library.

Questions & Answers

What is CISA advisory AA25-071A about Medusa ransomware?

AA25-071A is the joint #StopRansomware advisory from FBI, CISA and HHS, first published March 12, 2025 and updated August 18, 2026. The update counts more than 500 Medusa victims across critical infrastructure sectors as of April 2026, with healthcare and public health among the most frequently hit.

Which vulnerabilities does Medusa ransomware exploit?

The August 2026 update lists CVE-2024-1709 in ConnectWise ScreenConnect, CVE-2023-48788 in Fortinet FortiClient EMS, CVE-2025-10035 in Fortra GoAnywhere MFT, and CVE-2026-1731 in BeyondTrust Remote Support, and says affiliates adopt newly published exploits within 24 hours.

How much does Medusa charge victims to delay a data leak?

Per the advisory, Medusa runs double extortion with a 48-hour response window and a leak site countdown, and charges $10,000 in cryptocurrency per day to extend the deadline.

← Back to Threat Intel