aa25-071a-stopransomware-medusa-ransomware-508c.pdf (1 MB)

Medusa ransomware developers and affiliates had affected more than 500 victims across multiple critical-infrastructure sectors by April 2026, with healthcare organizations among their frequent targets. The operation obtains access through phishing, initial-access brokers, and rapid exploitation of vulnerabilities, then uses credential dumping, remote-management tools, Rclone, and the Gaze encryptor for lateral movement, exfiltration, and encryption. Its double-extortion model combines encrypted systems with threats to publish or sell stolen data, while one FBI-investigated case suggested either triple extortion or operational conflict among affiliates.