Medusa Ransomware Hits 500+Critical-Infrastructure Victims With Rapid Exploit Abuse

The FBI, CISA, and HHS have updated their joint advisory on Medusa, a ransomware-as-a-service
operation that has hit more than 500 organisations across critical infrastructure, including healthcare,
since 2021. Medusa affiliates break in by buying access from brokers, phishing staff, and rapidly
exploiting unpatched software flaws, then steal data and encrypt systems in a double-extortion
scheme, demanding payment to both decrypt files and prevent a public leak. The update adds newly
exploited vulnerabilities, faster exploit adoption, and expanded tooling, so organisations should patch
quickly, keep offline backups, and control remote-access software.

1. Campaign Overview

The FBI, CISA, and HHS updated joint advisory AA25-071A on 18 August 2026 with Medusa activity observed through April 2026. Medusa is a ransomware-as-a-service operation first seen in June 2021 that moved to an affiliate model in 2023, selling access to affiliates while developers sometimes run ransom negotiations centrally. Microsoft tracks the same activity as Storm-1175. As of April 2026 the group had hit more than 500 organisations across critical infrastructure, with healthcare a frequent target, and it runs a double-extortion model, stealing data and threatening to leak it on a Tor site if victims do not pay within 48 hours.

2. Attack Details

Initial access
Affiliates buy access from initial-access brokers, phish staff for credentials, and exploit unpatched internet-facing software, including ScreenConnect (CVE-2024-1709), Fortinet EMS (CVE-2023-48788), Fortra GoAnywhere (CVE-2025-10035), and BeyondTrust (CVE-2026-1731). They weaponise new exploits within 24 hours and use Interactsh URLs to confirm success.

Discovery and lateral movement
Using living-off-the-land tools and legitimate RMM software (AnyDesk, ConnectWise, SimpleHelp, Splashtop, and others) alongside RDP and PsExec, the actors enumerate the network with PowerShell, WMI, and CrackMapExec, then move laterally and open RDP through firewall and registry changes.

Credential access
The actors dump LSASS with Mimikatz and comsvcs.dll, register Mimikatz’s mimilib.dll to log plaintext passwords to kiwissp.log, and copy ntds.dit from a Volume Shadow Copy to forge Kerberos tickets and take over the domain. They disable Windows Defender through Group Policy and kill EDR with vulnerable drivers.

Exfiltration and encryption
Data is archived with Bandizip and exfiltrated with a renamed Rclone to Mega or Medusa C2. The gaze.exe encryptor (gaze.py on Linux) is pushed via PsExec, PDQ Deploy, or BigFix, excludes the C: drive from Defender, stops services, deletes shadow copies, encrypts with AES-256, appends .medusa, and powers off virtualmachines, while ESXi host profiles reset Linux root passwords.

3. Payload Capabilities

Medusa combines a cross-platform encryptor with hands-on credential theft and recovery destruction:

• gaze.exe encryptor: Deploys on Windows and Linux, terminates backup, security, database, and file-sharing services, deletes shadow copies, and encrypts files with AES-256, appending .medusa and dropping the !!!READ_ME_MEDUSA!!!.txt note.
• Credential harvesting: Dumps LSASS with Mimikatz and comsvcs.dll, plants mimilib.dll in the LSA Security Packages registry key to record plaintext passwords to kiwissp.log, and steals ntds.dit via Volume Shadow Copy to forge Kerberos tickets.
• Recovery inhibition: Deletes volume shadow copies and backup files, powers off and encrypts virtual machines, and overrides Group Policy by setting the Active Directory Default Domain Policy to Enabled and Enforced.
• Stealthy C2 and exfiltration: Hides tooling in Defender-excluded folders, tunnels with Ligolo-ng, Cloudflared, and GSocket, runs the Nezha and MeshAgent backdoor agents, and exfiltrates with a renamed Rclone to Mega.

4. Adversary Toolkit

5. Indicators of Compromise (IOCs)

• https://www.virustotal.com/gui/collection/fb803daf8595c73d2db28f4894e8e1e779033f619c846bf291be8cf38db564cd/ioc

6. Recommendations

• Patch the CVEs Medusa exploits (CVE-2024-1709, CVE-2023-48788, CVE-2025-10035, CVE-2026-1731) and prioritise known-exploited-vulnerability patching on internet-facing systems, since Medusa weaponises new exploits within 24 hours.
• Require phishing-resistant MFA on webmail, VPN, and critical accounts, and keep offline, immutable, segmented backups with regularly tested restoration.
• Allowlist approved RMM tools and block or alert on unauthorised ones (AnyDesk, Atera, SimpleHelp,
• Splashtop, Nezha, MeshAgent, Ligolo-ng, Cloudflared); segment networks and require VPN or jump hosts for remote access.
• Hunt for Medusa fingerprints: the .medusa file extension, the !!!READ_ME_MEDUSA!!!.txt note, gaze.exe, mimilib added to the LSA Security Packages registry key with a kiwissp.log file, tooling in Defender-excluded folders, and Volume Shadow Copy access to ntds.dit.
• Block the IOCs at their respective controls, https://www.virustotal.com/gui/collection/fb803daf8595c73d2db28f4894e8e1e779033f619c846bf291be8cf38db564cd/iocs

7. Sources

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
• https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnera
  ble-web-facing-assets-in-high-tempo-medusa-ransomware-operations/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.