The Medusa ransomware operation hit over 300 organizations in critical infrastructure sectors in the United States until February 2025.
The FBI, CISA, and MS-ISAC have issued a joint advisory on Medusa ransomware.
Medusa is a ransomware-as-a-service (RaaS) variant that has impacted various critical infrastructure sectors, including medical, education, legal, insurance, technology, and manufacturing.
Medusa operators employ various techniques and tools to gain unauthorized access, move laterally, perform reconnaissance, encrypt files, and conduct double extortion schemes.