Medusa ransomware gang has hit over 500 organizations, CISA warns

FBI, CISA, and HHS have issued an updated joint advisory revealing that the Medusa ransomware group has compromised more than 500 organizations since 2021. The agencies report that victims span critical sectors including healthcare, defense, manufacturing, and finance, with many organizations affected through unpatched vulnerabilities in products such as ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust.

Medusa operates via an affiliate model where operators deploy newly disclosed exploits within 24 hours of announcement rather than developing zero-days. To mitigate risk, defenders should immediately patch internet-facing systems, segment networks to restrict lateral movement, and block unauthorized remote access traffic.