A joint advisory from CISA, FBI, and MS-ISAC reveals that the Medusa ransomware operation has compromised more than 300 organizations across U.S. critical infrastructure sectors as of February 2025. The affected industries include medical, education, legal, insurance, technology, and manufacturing.
## Recommended Security Measures
To defend against Medusa ransomware attacks, organizations should:
– Patch operating systems, software, and firmware promptly
– Implement network segmentation to limit lateral movement
– Filter network traffic by blocking access from untrusted sources
## Evolution of Medusa
The ransomware operation first appeared in January 2021 but gained significant momentum in 2023 with the launch of its data leak site. Initially operating as a closed ransomware variant, Medusa has evolved into a Ransomware-as-a-Service (RaaS) model with affiliates, though its developers still manage core operations including ransom negotiations.
Medusa developers recruit initial access brokers through cybercriminal forums, offering payments ranging from $100 to $1 million USD for exclusive access to potential victims.
## Distinguishing Between “Medusa” Operations
It’s important to note that multiple cybercrime operations use the name “Medusa,” including a Mirai-based botnet and an Android malware service discovered in 2020 (also known as TangleBot). The Medusa ransomware operation is distinct from the MedusaLocker ransomware group, despite confusion in some reporting.
## Escalating Threat
Since its emergence, the gang has claimed over 400 victims globally. High-profile attacks include the Minneapolis Public Schools district in March 2023 and Toyota Financial Services in November 2023, where the group demanded an $8 million ransom.
According to Symantec’s Threat Hunter Team, Medusa ransomware attacks increased by 42% between 2023 and 2024, with activity in early 2025 nearly doubling compared to the same period in 2024.
This alert follows another recent joint warning from CISA and the FBI about Ghost ransomware attacks affecting victims across more than 70 countries.