What happened
On August 18, 2026, CISA, the FBI, HHS and partners updated advisory AA25-071A, originally published on March 12, 2025, with FBI investigative findings current through April 2026. The update says Medusa actors have impacted more than 500 organisations across critical-infrastructure sectors, compared with roughly 300 victims cited at the original publication. The affected-sector picture now explicitly spans Healthcare and Public Health, the Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology and Financial Services, with additional medical, education, legal, insurance, technology and manufacturing victims.
The updated advisory adds Fortra GoAnywhere CVE-2025-10035 and BeyondTrust CVE-2026-1731 to vulnerabilities used by Medusa actors. WaterISAC’s summary says the actors may weaponise newly announced vulnerabilities within 24 hours and, in some cases, exploit flaws up to a week before public disclosure. CyberScoop reports that Medusa uses access brokers and pays from $100 to $1 million, with many brokers also serving other ransomware variants. These details describe an access market and exploit tempo, not merely an encryption payload.
Attribution posture: U.S. agencies attribute the activity to the criminal Medusa ransomware-as-a-service operation but do not identify a state sponsor or named individual operators. The cited update did not identify which hashes, IP addresses or domains were newly added on August 18, so defenders should treat the live CISA advisory as the authoritative indicator set and record the retrieval time used for any hunt. The agencies’ assessment supports treating Medusa as an active criminal operation, while specific responsibility for any individual enterprise incident still requires local evidence. The cited source did not publish the specific indicators described as The update did not distinguish newly added indicators from the advisory’s existing indicator set.
Why this matters now
The scale increase is not simply historical victim accumulation. It is paired with evidence that Medusa’s operating model can buy access, reuse brokers serving multiple ransomware variants and rapidly convert a new disclosure into an intrusion path. Organisations that schedule high-risk remediation through ordinary weekly change processes may therefore be granting the attacker’s access market more time than defenders have allowed themselves.
The advisory also links ransomware exposure to products operated inside privileged or externally reachable parts of the enterprise and supplier estate. A patch dashboard covering only directly managed assets cannot answer whether a managed-service provider, inherited business unit or remotely administered platform has already been accessed through the same vulnerabilities.
The executive issue is readiness to make disruptive decisions quickly. Isolation of identity services, virtualisation management, backup administration or remote access may interrupt business activity, but delayed authority can allow credential theft, data staging and security-control tampering to convert a containable foothold into enterprise-wide extortion.
The update should change assurance language. “Patched” is not an acceptable closure statement when exploitation could precede disclosure or occur during the remediation interval. Closure requires evidence that the vulnerable path was removed and that systems, identities and adjacent control planes show no unresolved sign of access.
The decision for security leaders
Direct infrastructure, vulnerability management and supplier assurance to produce a single exposure view covering owned assets and services operated by third parties. The immediate question is not the total number of open findings; it is whether any Medusa-associated path reaches an internet-facing, privileged or operationally critical system.
Require incident response to define a compromise-assessment track that runs beside remediation. The hunt should cover the vulnerable interval, adjacent privileged identities, remote administration, security-tool changes, archive creation, unusual outbound transfer and access to backup or virtualisation management.
Pre-authorise isolation thresholds for systems whose continued operation could enlarge blast radius. Business owners should understand which services may be interrupted, who accepts the operational consequence and which evidence permits reconnection. That governance decision cannot wait for an extortion message.
Evidence of closure
- Signed asset report shows no exposed or unpatched instances of the cited CVEs.
- Threat-hunt record documents data sources, time range, findings and analyst disposition.
- Recovery exercise proves protected backups restore without production identity dependencies.
- Supplier attestations state exposure, compromise review and residual limitations.
The Security.io assessment
The most consequential change is the compression of defender time. An organisation may have a mature monthly patch programme and still be structurally slower than an operation that buys access or weaponises a disclosure inside one day. Exposure discovery, emergency ownership and isolation authority therefore matter as much as technical patch deployment.
The new CVE references should be treated as campaign scoping aids, not a complete Medusa exposure list. Access brokers can deliver compromised credentials or footholds produced by unrelated vulnerabilities, so a negative result for the two newly cited CVEs cannot establish that the environment is outside the campaign’s reach.
The victim-count increase is a lower-bound indicator of durable operating capacity, not a forecast that every organisation faces equal risk. Enterprises with exposed management interfaces, weakly governed remote access, fragmented acquisitions or opaque managed-service dependencies should assign the shortest decision horizon.
The cited update did not identify which hashes, IP addresses or domains were newly added on August 18, so defenders should treat the live CISA advisory as the authoritative indicator set and record the retrieval time used for any hunt. This limitation makes technique-led hunting and vulnerable-window analysis necessary alongside indicator matching.
Questions for the morning meeting
- Can we identify every externally reachable system inside one business day?
- Which suppliers operate affected products or remote-access paths for us?
- Who can authorise isolation that interrupts a critical service?
- What evidence distinguishes remediation from absence of compromise?