CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Medusa

malware · malware:medusa single-source

Ransomware-as-a-service operation that emerged in 2021 as a closed group and moved to an affiliate model in 2023, tracked by CISA, the FBI and HHS in the joint #StopRansomware advisory AA25-071A. The 2026-08-18 update, carrying FBI investigative data through April 2026, raised the recorded victim count from more than 300 to more than 500; the only sector list the cited reporting carries covers medical, education, legal, insurance and manufacturing. The agencies state affiliates exploit newly announced vulnerabilities within 24 hours and have been observed using exploits up to a week before public disclosure while developing no zero-day or N-day flaws of their own, obtaining that exploit access from sources the agencies could not identify. Separately from exploit access, initial-access brokers who sell entry into victim networks are paid between $100 and $1 million with a premium for exclusivity; post-compromise the affiliates use legitimate remote-management software and RDP rather than bespoke tooling. The group had added no new leak-site victims since April at the time of the update (CyberScoop and The Record, both 2026-08-18). Distinct from the unrelated MedusaLocker and MedusaHVNC families already tracked in this registry.

Coverage
4
1 about it · 3 mentions · first 2026-06-21 → last 2026-09-07
Latest activity
2026-08-19
A ransomware crew that develops no zero-days still beats the patch window, on exploits it obtains from…
Peak priority
notable
1 notable
Targets
healthcare
sectors: healthcare, education, legal-services · regions: us, europe
Sources cited
15
13 hosts

Defender insights

What each entry about Medusa tells a defender to do, newest first.

2026-08-19NOTABLEA ransomware crew that develops no zero-days still beats the patch window, on exploits it obtains from sources the agencies cannot identify

Triage

Story timeline

Every entry that names Medusa, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-09-07Recorded Future's H1 2026 Malware and Vulnerability Trends: two clusters reuse an identical post-exploitation tool stack across thirteen and ten unrelated initial CVEs
    mentionresearchInsikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro
  2. 2026-08-19Medusa's joint advisory update puts a number on the patch race: affiliates weaponise newly announced flaws within 24 hours, and the agencies find no sign the group develops any of them itself
    active-threatsA ransomware crew that develops no zero-days still beats the patch window, on exploits it obtains from sources the agencies cannot identify
  3. 2026-08-03CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
    mentiontrending-vulnerabilitiesN-able hotfixes an exploited N-central auth bypass after its earlier fix proved bypassable
  4. 2026-06-21HCRG Care Group first notifies patients of a February 2025 Medusa breach, 16 months on
    mentionactive-threats

Hunting pivots

Tags
data-breachorganized-crimeransomwarevulnerabilities
ATT&CK techniques (5 across 7 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • Lateral MovementRemote Services: Remote Desktop Protocol
  • Command and ControlRemote Access Tools
  • ImpactData Encrypted for Impact

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-19/medusa-raas-advisory-update-24-hour-weaponisation · ATT&CK page ↗

Entries about Medusa (1)

2026-08-19 · view entry permalink →

NOTABLENATOB1

Medusa's joint advisory update puts a number on the patch race: affiliates weaponise newly announced flaws within 24 hours, and the agencies find no sign the group develops any of them itself

CISA, the FBI and the Department of Health and Human Services published an update to the joint #StopRansomware advisory on Medusa on 2026-08-18, folding in FBI investigative findings through April 2026. The headline number is cumulative rather than current: CyberScoop records that "the victim tally in the advisory jumped from more than 300 to more than 500" (CyberScoop, 2026-08-18) since the original March 2025 advisory, roughly two hundred additional organisations identified over the intervening year. On sectors, the only list any of the cited outlets publishes is healthsystemCIO's, which records the figure as spanning every sector the agencies track, including medical, education, legal, insurance and manufacturing. HHS joined as a co-sealer specifically to add the healthcare perspective, describing the Healthcare and Public Health Sector as a frequent victim of Medusa activity (healthsystemCIO, 2026-08-18).

The finding worth carrying into planning is about speed, and it is unusual in being paired with an explicit negative. The agencies state the group exploits "newly announced exploits within 24 hours" and has "been observed to use exploits up to a week before public vulnerability disclosure", and then rule out the obvious inference: "However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching" (The Record, 2026-08-18). That combination is the planning fact. An organisation cannot out-wait this actor by assuming a research lead time the group has to fund itself: the pre-disclosure window comes from exploit access obtained somewhere the agencies could not identify, and the 24-hour window comes from acting on the same public advisory the defender is reading. A patch cycle measured in weeks is not a control against it, and the compensating control is exposure reduction on internet-facing software rather than faster patching alone.

The economics of entry are spelled out separately, and are not the same market as the exploit access above, these payments buy a way into a victim network, not a vulnerability. The gang relies on access brokers, "compensating them anywhere from $100 to $1 million, with higher prices going to those who work exclusively with Medusa", while most brokers work simultaneously for multiple ransomware variants (CyberScoop, 2026-08-18); The Record records the same exclusivity premium, noting Medusa "recruits members on cybercriminal forums and offers up to $1 million to initial access brokers who want to work exclusively for the group" (The Record, 2026-08-18). The practical consequence of brokers serving several operations at once is that an access sold into this ecosystem is not tied to one outcome; the same foothold may surface under a different brand.

Post-compromise, the advisory names the tooling rather than bespoke malware. Affiliates deploy credential-stealing tools first, then move to legitimate remote-management software to evade detection: "The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop" (The Record, 2026-08-18), with Remote Desktop Protocol for lateral movement (CyberScoop, 2026-08-18). Two products from the group's historically exploited list are named, each by a different outlet: CyberScoop records the advisory covering flaws in Fortra's GoAnywhere and BeyondTrust (CyberScoop, 2026-08-18), while healthsystemCIO is the outlet that identifies the February 2026 BeyondTrust disclosure as the advisory's own worked example of how quickly a public disclosure becomes an intrusion (healthsystemCIO, 2026-08-18).

One honest caveat belongs next to the victim count: The Record reports that "Medusa has not added any new victims to its leak site since April", with several experts attributing the pause to law-enforcement attention drawn by an attack on a US medical centre (The Record, 2026-08-18). The 500-plus figure is therefore a record of what happened through April, not evidence of a wave in progress; the advisory's value here is the tradecraft and the tempo, not a current-activity signal.

been observed to use exploits up to a week before public vulnerability disclosure

However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching

The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop.

The Record / Recorded Future News 2026-08-18

the victim tally in the advisory jumped from more than 300 to more than 500

CyberScoop 2026-08-18

Medusa has not added any new victims to its leak site since April

The Record / Recorded Future News 2026-08-18
threat19 Aug 05:20Zmulti-sourceOpen finding →
Sources: The Record / Recorded Future News · CyberScoop · healthsystemCIO

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2
  • Vulns1
  • Research1

Source distribution

  • status.n-able.com2 (13%)
  • therecord.media2 (13%)
  • cisa.gov1 (7%)
  • cyberscoop.com1 (7%)
  • healthsystemcio.com1 (7%)
  • hipaapulse.com1 (7%)
  • huntress.com1 (7%)
  • microsoft.com1 (7%)
  • other5 (33%)
All cited sources (15)