Medusa Ransomware: CISA, FBI, and HHS Issue Urgent Warning for Healthcare and SMBs

Also on CyberFence: CyberFence for Teams for business VPN with BAA and SSO · business VPN alternatives to NordLayer .

On August 18, 2026, CISA, the FBI, and the Department of Health and Human Services issued an updated joint cybersecurity advisory on Medusa ransomware — the most significant update to the advisory since it was first published in March 2025. The update reflects FBI investigation findings through April 2026, documents that more than 500 organizations have been compromised, and adds HHS as a co-sealing agency for the first time, signaling intensified focus on healthcare sector targeting.

The advisory is classified as a #StopRansomware advisory, the highest-priority public warning format used by US cybersecurity agencies. It covers a ransomware operation that targets phishing victims, exploits unpatched software vulnerabilities, and uses a double-extortion model that threatens to publicly release stolen data if the ransom isn't paid. Healthcare organizations, legal firms, schools, insurance companies, and technology companies are all named as target sectors.

What Medusa Ransomware Does

Medusa is a ransomware-as-a-service (RaaS) operation that has been active since 2021. It began as a closed operation controlled by a single threat actor group and later adopted an affiliate model — recruiting criminal partners through dark web forums to carry out attacks in exchange for a share of ransom proceeds. Initial access brokers can earn between $100 and $1 million for selling access to a victim organization's network to Medusa operators.

The attack chain follows a consistent pattern:

• Initial access via phishing — Phishing is explicitly identified in the CISA advisory as the primary method Medusa uses to steal victim credentials. Targeted phishing emails directed at employees in healthcare, legal, education, and financial organizations deliver credential-harvesting links or malicious attachments that compromise an account. That one compromised account is all Medusa needs to start the attack.
• Vulnerability exploitation — In addition to phishing, Medusa affiliates exploit unpatched software. Two specific CVEs are documented: CVE-2024-1709 (ScreenConnect authentication bypass) and CVE-2023-48788 (Fortinet EMS SQL injection). Organizations running unpatched versions of remote access or management software are at elevated risk.
• Lateral movement using legitimate tools — Once inside, Medusa actors use legitimate remote administration tools — AnyDesk, ConnectWise, Atera, Splashtop, N-able, SimpleHelp — to move through the network while evading detection. They also use Mimikatz to dump credentials from Windows memory, enabling access to additional accounts and systems.
• Data exfiltration before encryption — Before encrypting anything, Medusa actors use Rclone to exfiltrate sensitive data to their command-and-control servers. This data becomes the lever for double extortion.
• Encryption and extortion — The encryptor (`gaze.exe`) deletes shadow copies, disables backup and security services, and encrypts files with AES-256, appending the `.medusa` extension. A ransom note demands contact within 48 hours. If victims don't respond, Medusa actors may call or email directly. For organizations that go silent, the stolen data is listed on a dark web leak site with a countdown timer — victims can pay $10,000 in cryptocurrency per day to extend the deadline.

Why Healthcare Organizations Are the Primary Target

The addition of HHS as a co-issuing agency on the August 18 advisory is significant. HHS joins CISA, FBI, and MS-ISAC because healthcare organizations are experiencing the highest density of Medusa attacks. The reason is straightforward: healthcare organizations hold patient health information (PHI) that is both legally protected and highly sensitive — making the double-extortion threat of public release especially coercive. A hospital cannot allow patient records to be publicly posted on a dark web leak site.

Medical practices, dental offices, mental health providers, physical therapy clinics, home health agencies, and hospital systems all fall within Medusa's documented target profile. Any organization handling PHI that runs unpatched software or whose employees are susceptible to phishing is a viable target under the affiliate model described in the advisory.

The CISA advisory makes explicit that phishing is the most common initial access vector. For healthcare and other targeted sectors, that means every employee who receives email is a potential entry point. Medusa doesn't need to crack encryption or find a zero-day — it needs one employee to click a credential-harvesting link from a public Wi-Fi connection or an unsecured home network.

The Remote Work and Public Wi-Fi Connection

One of the most significant risk factors documented in the Medusa advisory — and one that applies directly to remote and hybrid workers across all targeted sectors — is the phishing-to-credential-theft pipeline. When a healthcare administrator, legal professional, or insurance employee accesses work email from a coffee shop or hotel network, two compounding risks emerge:

Network-level credential interception: On public Wi-Fi without encryption, session tokens and login credentials for webmail and remote access portals can be intercepted by other devices on the same network. An employee checking their work email at a coffee shop may inadvertently expose the credentials Medusa actors need to initiate an attack — without clicking any phishing link at all.

Phishing link delivery over unsecured channels: Phishing emails are delivered to work email accounts that employees access everywhere — home networks, coffee shops, airports, client sites. CyberFence's Web Shield DNS filtering blocks known phishing domains before the browser loads the page, regardless of what network the employee is on. If a Medusa affiliate sends a phishing email containing a link to a credential-harvesting domain impersonating a healthcare portal, a VPN login page, or a software update notification, Web Shield intercepts the DNS query and blocks the connection before any page content is returned.

What the Advisory Recommends — And How CyberFence Addresses Each Point

The CISA/FBI/HHS advisory provides a prioritized mitigation list. Here's how CyberFence maps to the most actionable items for organizations and individuals:

• "Require multifactor authentication for all services, particularly webmail and VPNs" — CyberFence adds an encryption layer to remote access regardless of MFA status. Even if an attacker steals credentials, an encrypted VPN session makes it harder to extract session tokens from network traffic.
• "Filter network traffic to prevent unknown or untrusted origins from accessing remote services" — CyberFence routes all outbound traffic through encrypted tunnels, obscuring which remote services are being accessed and preventing passive network surveillance on shared networks.
• "Require VPNs or jump hosts for remote access" — This is explicitly recommended in the advisory. CyberFence provides the VPN layer for employees accessing organizational resources remotely, encrypting all traffic between their device and the internet.
• "Monitor for unauthorized scanning and unexpected remote-access software" — CyberFence's Web Shield blocks known malicious domains used by remote access trojan (RAT) delivery campaigns and phishing operations that distribute the tools Medusa uses for initial access.
• "Phishing remains the single most common initial vector — user training controls recommended" — Web Shield provides a technical enforcement layer that works even when user training fails. It blocks phishing domains at the DNS level, providing protection that doesn't depend on the user recognizing a malicious link.

The 500+ Organizations — And What That Number Means for SMBs

The updated advisory documents 500+ compromised organizations as of April 2026, up from 300 in the original 2025 advisory. The sectors listed — medical, education, legal, insurance, technology, manufacturing — are predominantly small-to-midsize organizations. Hospital systems have enterprise security teams; a five-provider medical practice, a regional law firm, or a regional insurance agency typically does not.

Medusa's affiliate model is specifically designed to reach organizations of any size. Affiliates are paid for successful access sales — the barrier to entry for an affiliate to target a small medical practice or a legal office is identical to targeting a large hospital. Initial access via a phishing email works the same way against a 10-person practice as against a 10,000-employee health system.

For small organizations in targeted sectors, the practical defense is straightforward: encrypt remote access connections, block phishing domains at the network layer, and ensure every device used for work access is covered — not just devices on the office network, but employee phones, laptops, and home computers used for remote work.

What to Do Right Now

• Patch internet-facing software immediately — if your organization uses ScreenConnect or Fortinet EMS, verify both are updated; both CVEs documented in the advisory have patches available
• Enable MFA on all remote access portals — especially webmail, VPN portals, and any cloud-based system used by employees
• Protect every device with VPN and phishing-blocking — every device used to access work systems is a potential Medusa entry point if compromised by phishing on a public or home network
• Verify backups are offline and tested — Medusa specifically targets and disables backup services; offline, immutable backups are the recovery option if encryption occurs
• Report incidents promptly — contact the FBI's Internet Crime Complaint Center (IC3) or CISA at report@cisa.gov if you suspect compromise

Want to go deeper? Read the CyberFence Teams product page , the CyberFence vs. NordLayer feature comparison , or CyberFence vs. Perimeter 81 pricing and features .