# Medusa Ransomware: What the CISA/FBI Advisory Means for a Small Firm URL: https://limehawk.io/reports/medusa-ransomware Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Medusa is ransomware-as-a-service that steals your files, then encrypts them. Isolate machines, don't pay or wipe anything, call IT, and report it to the FBI. > **TL;DR** Medusa is a ransomware-as-a-service operation the FBI has tracked since June 2021. CISA, the FBI, and MS-ISAC published joint advisory AA25-071A on it on March 12, 2025, and the FBI, CISA, and HHS updated it on August 18, 2026. Medusa gets in through phishing and unpatched internet-facing software, uses ordinary remote support tools to move around, copies your files out, then encrypts. If you see a Medusa ransom note: disconnect the affected machines from the network, don't pay, don't wipe or rebuild anything, call your IT provider, and report it to the FBI or CISA. Prevention is boring and it works: patching, phishing-resistant MFA, locked-down remote access, and offline backups. - Medusa victims (FBI, as of Apr 2026): 500+ ## What should I do right now if I see a Medusa ransom note? Pull the network cable or turn off Wi-Fi on every machine showing the note, and leave them powered on. Don't pay, don't reply to the attackers, and don't wipe or rebuild anything yet. Call your IT provider from a phone, not a work computer, then report it to the FBI or CISA. Here's the order we'd want a client to follow: 1. **Disconnect, don't shut down.** CISA's advisory says to isolate compromised hosts "by quarantining or taking them offline." CISA's [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) says to power a device down only if you can't get it off the network. Unplugging stops the spread and keeps evidence for whoever investigates. 2. **Don't pay and don't negotiate.** The [advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a) says the FBI, CISA, and HHS "do not encourage paying ransom as payment does not guarantee victim files will be recovered." The note will push you to make contact within 48 hours. That deadline is pressure, not a reason to skip steps. 3. **Don't wipe or "clean up."** Reimaging a PC, deleting the note, or running a random cleanup tool destroys the logs your IT team and your insurer need. Rebuilding is a later step, and it's IT's job. 4. **Call IT from a clean device.** Use a personal phone. Assume work email and chat are being watched until someone checks. 5. **Call your cyber insurance carrier** if you have one, early. Your [incident response plan](/reports/incident-response-plan-template) should have the number written down. 6. **Report it.** The advisory asks victims to report to the [FBI's IC3](https://www.ic3.gov), a local FBI field office, or CISA at 1-844-729-2472, whether or not you pay. 7. **Reset passwords from a clean device,** starting with email and admin accounts, once IT says the attacker's access is cut off. If your firm holds client files under a confidentiality duty, like a [law firm](/industries/law-firms), loop in whoever handles breach notice early. A Medusa attack is a data theft, not just an outage. ## What is Medusa ransomware? Medusa is a ransomware-as-a-service (RaaS) operation, first identified in June 2021. According to [CISA advisory AA25-071A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a), it started as a closed group and has used an affiliate model since at least early 2023. The developers rent the ransomware to affiliates and sometimes run the ransom negotiation themselves. The advisory first came out on March 12, 2025, from the FBI, CISA, and the Multi-State Information Sharing and Analysis Center (MS-ISAC). At that point the FBI counted over 300 victims as of February 2025. The August 18, 2026 update, now co-sealed by the FBI, CISA, and HHS, puts the count at 500+ victims as of April 2026. The sectors it names include medical, education, legal, insurance, technology, and manufacturing. **Medusa is not MedusaLocker.** The FBI says the Medusa ransomware variant "is unrelated to the MedusaLocker variant and the Medusa mobile malware variant." If you're reading guidance online, check which one it's about. Same name, different crews. ## How does Medusa get into a small business? Two ways, mostly: phishing and unpatched software facing the internet. The advisory says Medusa affiliates buy access from "initial access brokers" and use phishing "as a primary method for stealing victim credentials." They also exploit known holes in internet-facing products, and they pick victims by what's unpatched, not by who they are. The software named in the advisory is the kind small firms actually run: ConnectWise ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust. The advisory says Medusa actors "operate opportunistically" and watch for vulnerability announcements. Translation: when a patch comes out for something on your perimeter, the clock starts for you too. Phishing is the other door. A stolen password with no second factor is all they need for webmail or a VPN. That's the same path we see in [business email compromise](/reports/business-email-compromise), and it's why the advisory asks for phishing-resistant MFA, not just any MFA. ## Why does Medusa use normal IT tools? Because they blend in. Once inside, Medusa affiliates install or reuse ordinary remote support software. The FBI saw them use AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop, and the advisory says they "may tailor their choice based on remote access tools already present in the victim environment." That last part matters. If your office already has three remote tools from three past IT vendors, one more session looks normal. They pair those tools with Remote Desktop (RDP), PsExec, and PowerShell to move from machine to machine. They're using things that are supposed to be there, so plain antivirus often has nothing to flag. That's the gap [EDR](/reports/edr-vs-antivirus) fills: it watches what a tool does, not just what file it is. ## What is double extortion? Double extortion means they steal your data first, then encrypt it, and charge you for both. Medusa's leak site posts victims with a countdown to publication and links to a payment wallet. The advisory says Medusa also advertises the data for sale before the timer runs out, and "there is no way to verify" they delete anything. It gets worse. In one FBI case, after a victim paid, a separate Medusa actor said the negotiator had stolen the payment and asked for half of it again for the "true decryptor." The advisory calls it "potentially" a triple-extortion scheme. This is why backups alone don't solve Medusa. A good backup gets your files back. It doesn't un-steal them. ## What does the advisory say to do, in small-firm terms? The [mitigations section](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a) is written for big networks. Here's how it reads for a 5-50 person office: - **Patch internet-facing things first.** Firewall, VPN, remote support portal, file transfer server. The advisory says to prioritize known exploited vulnerabilities. - **Phishing-resistant MFA** on email, VPN, and admin accounts. Security keys or passkeys, covered in our [phishing-resistant MFA guide](/reports/phishing-resistant-mfa). - **One approved remote access tool.** Remove the leftovers and block the rest. The advisory says to require a VPN or jump host for remote access. - **No RDP open to the internet.** We've [found it exposed](/reports/open-rdp-onboarding-discovery) on a new client's first day. - **Least privilege.** Staff don't use admin accounts for daily work. Check for accounts you don't recognize. - **EDR plus someone watching it.** The advisory says EDR is "particularly useful for detecting lateral connections." - **Segment the network** so one infected PC can't reach every server. - **Offline, encrypted, immutable backups,** tested. Follow the [3-2-1 rule](/reports/3-2-1-backup-rule) with one copy the network can't reach. - **Long passwords.** The advisory points to NIST and says to consider dropping forced password changes every few months. None of that is exotic. It's the same baseline we'd point to for [Akira](/reports/akira-ransomware) and [Qilin](/reports/qilin-ransomware). ## Key takeaways - Medusa is ransomware-as-a-service. It's unrelated to MedusaLocker and to the Medusa mobile malware, per the FBI. - First hour: disconnect, don't pay, don't wipe, don't use the infected network to talk about it, call IT, report to the FBI or CISA. - It gets in through phishing and unpatched internet-facing software, then hides inside normal remote support tools like AnyDesk, ScreenConnect, and Splashtop. - Double extortion means a backup gets your files back but doesn't stop the leak. You need both prevention and recovery. - The advisory's fixes for a small firm: patch fast, phishing-resistant MFA, one approved remote tool, no open RDP, EDR, and offline backups you've test-restored. ## What this looks like when we do it On our [managed IT and security](/services/managed-it-security) baseline, every machine gets EDR and 24/7 monitoring, MFA is enforced across the tenant, and backups are kept and tested so a restore is a known quantity. We standardize on one remote support tool and pull out the ones left behind by past vendors, because a stray AnyDesk install is exactly what the advisory describes Medusa hiding in. Internet-facing RDP gets closed on day one. When something does go wrong, critical issues get a response in under 15 minutes. We isolate the affected machines, preserve what the investigators need, and work with your insurer instead of around them. If you're a [law firm](/industries/law-firms) or another office holding client files, the [managed IT and security](/services/managed-it-security) page covers what's in the baseline. Want to know how your firm stacks up against the Medusa advisory? Book a call and we'll walk through it.