What is Medusa ransomware?

Medusa is a ransomware-as-a-service operation first identified in June 2021, not to be confused with the unrelated MedusaLocker family or a mobile malware also called Medusa. CISA, the FBI and the MS-ISAC described it in joint advisory AA25-071A of 12 March 2025, reporting more than 300 victims by February 2025 in critical infrastructure sectors including medical, education, legal, insurance, technology and manufacturing; an update in August 2026 raised the count to more than 500 victims as of April 2026. Its developers and affiliates get in through phishing to steal credentials and by exploiting unpatched vulnerabilities, and the advisory describes heavy use of legitimate remote-access software and built-in admin tools. Medusa runs a leak site with countdown timers and offers to delay publication for a fee. The mitigations are the familiar set: patch operating systems, software and firmware; multi-factor authentication for all services; network segmentation; offline backups; and limiting remote-desktop and remote-access tools to the ones you actually use.

← All 25 questions on Ransomware groups and familiesAll topics