Medusa Turns Brokered Access Into Faster Intrusions
The FBI, CISA, and HHS said on August 18 that Medusa ransomware has hit more than 500 critical-infrastructure organizations, up from a March 2025 tally of more than 300. The updated advisory says the group’s reach now spans healthcare, defense, manufacturing, government, IT, and financial services, with education and law firms also in the mix.
The agencies say Medusa buys initial access from brokers, and most of those brokers will sell the same foothold to multiple buyers. It then uses that access quickly, including newly announced exploits within 24 hours, so a disclosed flaw can become an intrusion route before many defenders finish validating exposure. ScreenConnect is among the recent targets named in the advisory.
That makes the campaign less about a single gang breaking in and more about how fast one exposed system can be turned into parallel compromises across different victims. For organizations that rely on internet-facing remote-access, file-transfer, or admin tools, the lasting risk is that patch-day delay can hand Medusa an already-working path in more than one place at once.
CISA: Medusa ransomware hit over 500 critical infrastructure orgs
The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021.