#StopRansomware: Medusa Ransomware

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Medusa Ransomware Last Revised August 18, 2026 Alert Code AA25-071A Related topics: Cybersecurity Best Practices , Organizations and Cyber Safety , Critical Infrastructure Security and Resilience Advisory at a Glance Title #StopRansomware: Medusa Ransomware Original Publication March 12, 2025 Last Update Aug. 18, 2026 Executive Summary The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and U.S. Department of Health and Human Services (HHS) are releasing this updated joint advisory to disseminate known Medusa ransomware tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) identified through FBI investigations as recently as April 2026. Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. Both Medusa developers and affiliates use a double-extortion model where they encrypt victim data and threaten to publicly release exfiltrated data if a ransom is not paid. Last Update Description The update expands details on Medusa actors’ operations, including more specifics about their affiliate model and payment ranges for initial access brokers, as well as a broader list of exploited vulnerabilities. It describes Medusa’s opportunistic targeting and use of Interactsh URLs for exploit verification. It also lists additional tools for network enumeration, persistence, and stealth, including detailed PowerShell obfuscation techniques and command-and-control utilities. Additionally, HHS has been added as a co-sealer, providing their insights into Medusa’s operations against the Healthcare and Public Health Sector. Key Actions Mitigate known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date within a