The Federal Bureau of Investigation (FBI), Cybersecurity & Infrastructure Security Agency (CISA), and HHS have released an updated joint advisory on Medusa ransomware, incorporating tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) identified through FBI investigations as recently as April 2026. Medusa operates as ransomware-as-a-service (RaaS) and uses a double-extortion model, encrypting victim data while threatening to publicly release stolen information if a ransom is not paid. The update provides new details on Medusa’s affiliate model, exploitation of additional vulnerabilities, opportunistic targeting, use of Interactsh URLs for exploit verification, PowerShell obfuscation, command-and-control utilities, and other tools used for network enumeration, persistence, and stealth. HHS also contributed insights into Medusa activity affecting the Healthcare and Public Health Sector.
Organizations can reduce their exposure by promptly patching known vulnerabilities, keeping operating systems, software, and firmware up to date within risk-informed timeframes. Organizations should also segment networks to restrict lateral movement and filter network traffic to prevent unknown or untrusted sources from accessing remote services on internal systems.