Medusa Ransomware Expands Victim Count with New Tactics

The Medusa ransomware group has increased its victim count from over 300 to more than 500 in just over a year, as reported in a U.S. government advisory. The group employs access brokers, paying them between $100 and $1 million to gain entry into networks. Medusa targets unpatched software vulnerabilities, particularly affecting the Healthcare and Public Health sector. Exploited vulnerabilities include flaws in Fortra GoAnywhere and BeyondTrust software. Medusa actors leverage legitimate tools and living off the land techniques to evade detection. They have been observed using exploits within 24 hours of their announcement. The advisory updates previous guidance from March 2025 and highlights ongoing FBI investigations into the group. Medusa is known for opportunistic attacks rather than targeting specific organizations.

Key Points: • Medusa ransomware has increased its victim count to over 500 in just over a year. • The group utilizes access brokers, compensating them significantly for network access. • Healthcare and Public Health sectors are frequently targeted due to unpatched vulnerabilities.