Medusa Ransomware Reaches 500 Victims as CISA Flags Pre-Disclosure N-Day Exploitation in Healthcare

The advisory documents Medusa’s shift to an affiliate model in 2023, with central control over negotiations for newer operators and recruitment of initial access brokers offering up to $1 million exclusivity payments. Victims include the University of Mississippi Medical Center, which lost all pediatric, trauma, and transplant services after the April 2026 attack. Technical indicators show consistent use of credential dumpers followed by legitimate remote monitoring tools including AnyDesk, Atera, and Splashtop to maintain access.

Evidence reveals Medusa operators exploit newly announced vulnerabilities within 24 hours and have been observed using some N-day flaws up to a week before public disclosure, relying on purchased or leaked access rather than developing their own. One FBI-investigated incident showed a second Medusa actor demanding an additional payment after the first ransom, indicating either internal theft or an emerging triple-extortion pattern not previously detailed in public reporting.

Original coverage understated the operational friction inside the group and the speed of exploit adoption across multiple ransomware crews. Procurement records and contract awards show healthcare entities continue to lag in patch deployment windows shorter than 48 hours, creating repeatable attack surfaces that align with Medusa’s observed tactics.

Law enforcement attention after the Mississippi incident has kept the group’s leak site dormant since April, suggesting sustained pressure on infrastructure and affiliates that may force further decentralization or rebranding by late 2026.