Medusa's Affiliate Model Hits Full Stride: 500 Critical-Infrastructure Victims and a Hint of Cracks Beneath- 339
August 20, 2026
An updated federal advisory on the Medusa ransomware-as-a-service operation reads less like a warning about a single gang than a case study in how ransomware has industrialized: a service model recruiting freelance intruders on criminal forums, a victim count that has nearly doubled in a year, and — buried in the technical detail — the first documented sign that the extortion economy Medusa built may be starting to turn on itself.
The Cybersecurity and Infrastructure Security Agency, the FBI and the Department of Health and Human Services updated their joint advisory on Medusa this week, expanding on a baseline first published in March 2025 and drawing on continuing FBI investigations. The headline figure alone marks the group's trajectory: from more than 300 confirmed victims as of 2025 to more than 500 by April 2026, many concentrated in critical-infrastructure sectors.
Medusa emerged in 2021 as a closed ransomware operation before converting to an affiliate model in 2023, selling access to its ransomware to outside operators who are granted tiered levels of access according to experience and track record.
For newer or less proven affiliates, sensitive functions such as ransom negotiation remain centrally controlled by the group's developers rather than handed off. The group also runs a parallel market for access itself, paying independent initial-access brokers anywhere from $100 to $1 million depending on the value of the intrusion, with the highest rates reserved for brokers willing to work exclusively for Medusa — though the advisory notes most brokers sell access to several ransomware variants simultaneously, underscoring how commoditized initial access has become across the ransomware ecosystem generally, not just within Medusa's own supply chain.
Technically, Medusa's advantage lies less in novel intrusion techniques than in speed and opportunism. The advisory describes the group as targeting victims with unpatched software rather than specific organizations or sectors, though the Healthcare and Public Health sector has borne a disproportionate share of attacks — a pattern reinforced by outside reporting that North Korean-linked hackers have separately leaned on Medusa to hit healthcare targets, and that the China-linked Storm-1175 group used Medusa in earlier fast-moving campaigns before pivoting to its own ransomware. Medusa affiliates have exploited flaws in Fortra's GoAnywhere and in BeyondTrust products, and the advisory is explicit that the group does not appear to develop its own zero-day or n-day exploits; instead, it moves quickly to weaponize newly disclosed vulnerabilities — within 24 hours in some cases, and reportedly as early as a week before public disclosure, obtaining early access to exploit code from unspecified outside sources. Once inside a network, affiliates favor living-off-the-land techniques over custom malware, using legitimate remote monitoring and management tools and remote access services — including AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop — together with Remote Desktop Protocol for lateral movement, before turning to credential-theft utilities to support data exfiltration and ransomware deployment. Researchers describe the resulting timeline as compressing sharply: SafeBreach's Adrian Culley characterized the trend as attackers moving from initial access to data exfiltration in hours rather than days, calling it part of a broader escalation in the speed and coordination of ransomware operations across the industry.
The advisory's release follows the incident most responsible for the group's rising profile: an April attack that shut down the University of Mississippi Medical Center, the state's only children's hospital, only Level I trauma center, only Level IV neonatal intensive care unit and only organ-transplant program. Medusa has added no new victims to its leak site since that attack, which several researchers interpret as a sign the operation drew unwelcome law enforcement attention rather than a slowdown in activity. The advisory also details Medusa's negotiation tactics — victims who pay quickly are typically offered reduced ransoms calculated against publicly reported revenue, and a $10,000 payment can buy one additional day before stolen data is published, though the group's practice of removing victim data from its leak site after payment cannot be independently verified. Most notably, investigators cite one case in which a victim who had already paid was subsequently contacted by a second, separate Medusa actor claiming the original negotiator had stolen the ransom and demanding half the payment again for the "true decryptor" — an incident the advisory frames as potential evidence of either a triple-extortion scheme or genuine operational dysfunction within the group, a rare documented crack in the coordination of an otherwise fast-scaling ransomware-as-a-service operation.
