SURIQ
The headline number from CISA's updated Medusa advisory is 500, the count of critical infrastructure organizations this ransomware crew has hit since 2021. The number that should reshape your week is smaller: 24, the hours Medusa affiliates now take to turn a freshly disclosed vulnerability into a live intrusion. That speed, restated by CISA and the FBI on August 18, breaks the assumption underneath most patch programs, that you have days to test a fix and roll it out. Against a group that weaponizes a bug the day it drops, patching is a race you have probably already lost.
The joint advisory AA25-071A, refreshed by CISA, the FBI, and federal health regulators on August 18, 2026, adds more than 200 victims to the tally first published in March 2025. The list skews hard toward healthcare and the public sector. The Record names one victim to make it concrete: the University of Mississippi Medical Center, home to the only children's hospital in the state and its Level I trauma center, breached in April 2026.
The 24-hour window changes what defense means
Most patch programs are built around a tolerance: a critical fix goes out in a few days, a high in a week or two, after a change window and some testing. That tolerance assumes attackers move slower than you do. Medusa does not. CISA's own language, that affiliates exploit newly announced vulnerabilities within 24 hours, means the gap between a public advisory and a live intrusion can be shorter than your fastest emergency change.
If the attacker is faster than your patch cycle by design, then the metric that decides the outcome is not time-to-patch. It is time-to-detect. A week-long patch SLA is still weeks too slow against a same-day weaponizer, so the question shifts from "did we patch in time" to "would we know, in the hours after they got in, before the files start encrypting." That reframing is uncomfortable because it admits the front door will sometimes open. It is also more honest. Medusa is not the first crew to make this trade: we made the same point about how ransomware crews mostly live off unpatched edge devices rather than novel zero-days.
Medusa rents its way in
Medusa runs as a service. The core operators recruit initial access brokers on criminal forums and pay them anywhere from a few hundred dollars to as much as a million for a working foothold, then their affiliates do the encryption. Access is a separate specialized business from the ransomware itself, which is why the two well-documented entry points in CISA's advisory are both older, already-patched edge flaws: an authentication bypass in ConnectWise ScreenConnect (CVE-2024-1709, CVSS 10.0) and a SQL injection in Fortinet FortiClient EMS (CVE-2023-48788, CVSS 9.8). Brokers also simply log in with phished VPN, remote-desktop, and email credentials.
That division of labor is a defensive opening, not just a threat. A broker who sells your network on Monday is not the same actor who detonates ransomware on Thursday. The dwell time between the sale and the encryption is often days, and that window is the best detection opportunity most defenders will get. It is the same logic behind watching for access brokers who quietly stage a foothold and sell it on: the loud part comes last, and by then it is too late to prevent, only to recover.
The tools that hide Medusa are the tools you trust
Once inside, Medusa affiliates rarely reach for exotic malware. They use legitimate remote-access software like AnyDesk, ConnectWise, and BeyondTrust to keep control, and native Windows tooling, PowerShell and Windows Management Instrumentation, plus off-the-shelf scanners like Advanced IP Scanner and SoftPerfect Network Scanner, to map the network. Credential theft runs through Mimikatz against the Windows LSASS process. None of that trips a signature. All of it looks like a busy admin at 2am.
This is where a lot of defenses quietly fail. Endpoint tools allowlist the same remote-management software that IT depends on, so a second copy of AnyDesk installed by an intruder blends into the noise. The fix is cheaper than another signature feed: decide which one remote-access tool your organization sanctions, inventory where it runs, and alert on any other one appearing anywhere. An unsanctioned remote-access tool is one of the highest-signal, lowest-noise ransomware precursors you can hunt, and it usually fires before the file locker does. The broader lesson is the one we keep returning to, that the useful alarm is often watching the login rather than the file locker, and that a security agent going quiet is itself an event worth paging on.
What to do this week
The advisory's mitigations are the familiar ransomware baseline, and they work because Medusa's tradecraft is ordinary. Prioritize by what shrinks the attack surface a broker sells:
- Cut internet-facing exposure. Anything a broker can reach is anything they can sell. Put remote-management and file-transfer consoles behind a VPN or identity-aware proxy, and patch edge services fast, treating them as the emergency, not the routine, change.
- Require phishing-resistant multi-factor authentication on VPN, remote desktop, email, and any external remote-access tool. Most broker access is a valid login, not an exploit.
- Baseline your remote-access tools and alert on the rest. Pick the one you sanction, know where it runs, and treat any other remote-management binary as an incident until proven otherwise.
- Segment the network so a single compromised host cannot reach your whole estate, and restrict internal remote services to trusted origins.
- Keep tested, offline backups. Double extortion means they steal before they encrypt, so backups limit the encryption damage but not the leak. Restore drills matter more than backup existence.
The jump from 300 victims to 500 is not evidence of some new technical capability. It is evidence of a maturing market for network access, where the break-in and the ransomware are bought and sold separately and the crew that encrypts you never had to find the way in. Defending the front door, exposed services and stolen credentials, is now defending against the whole broker economy, not just Medusa. That is the more durable investment, because the next crew will rent from the same brokers.