CISA Warns Medusa Ransomware Hackers Steal Data, Kill Security Tools, and Encrypt Entire Networks
Brief
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U. S. Department of Health and Human Services (HHS) have jointly released an updated security advisory warning that Medusa ransomware threat actors are actively infiltrating enterprise environments, disabling security tools, exfiltrating sensitive files, and encrypting entire networks.
The updated alert (AA25-071A) reflects comprehensive forensic findings through April 2026, confirming that Medusa has compromised more than 500 organizations across critical infrastructure sectors including healthcare, education, legal, insurance, manufacturing, and technology.
CISA Warns Medusa Ransomware Steals Data
First observed in June 2021 as a closed malware operation, Medusa shifted toward an industrialized Ransomware-as-a-Service (RaaS) model around 2023.