CISA and HHS Issue Joint Advisory on Medusa Ransomware After Healthcare Targets Spiked Through August

CISA, the FBI, and the Department of Health and Human Services on August 18 jointly published a #StopRansomware advisory on Medusa, a ransomware-as-a-service operation whose affiliates have accelerated attacks on healthcare and critical-infrastructure operators over the past 90 days. The advisory, distributed via the FBI's Internet Crime Complaint Center (ic3.gov), adds HHS as a co-sealing agency for the first time this year and gives defenders a single document with technical indicators, known affiliate tradecraft, and recommended mitigations.

What Medusa Actually Does

Medusa is a ransomware-as-a-service strain that surfaced in 2023 and has since evolved into one of the more aggressive double-extortion operations in active use. Affiliates gain initial access through a mix of phishing, exposed Remote Desktop Protocol endpoints, and exploits for unpatched edge devices. Once inside, Medusa actors disable endpoint security products, exfiltrate sensitive data, and then encrypt the entire network — a pattern cybersecurity news site CybersecurityNews.com said on August 18 「stole data, killed security tools, and encrypted entire networks」 across a series of recent healthcare intrusions. The Medusa crew runs a public leak site that doubles as a pressure tactic, naming non-paying victims and posting partial data dumps.

Why HHS Is Now a Co-Sealer

Healthcare became Medusa's most-targeted sector in the second quarter of 2026, according to public leak-site activity tracked by threat-intelligence firms. The HHS co-seal reflects a recognition that hospital and clinic intrusions carry a direct public-health cost — canceled procedures, diverted ambulances, and delayed care — that other sectors do not. By co-signing the advisory, HHS adds regulatory weight to mitigations it expects to see enforced in its HIPAA audits over the next two quarters.

What Defenders Are Told to Do

The advisory walks through indicators of compromise, YARA rules for detecting Medusa artifacts, and a prioritized mitigation list: enforce multi-factor authentication on all remote-access accounts, patch internet-facing applications within 24 hours of CVE disclosure, segment networks to limit lateral movement, retain immutable backups offline, and audit privileged accounts for the credential-dumping patterns Medusa affiliates use. The advisory also stresses user-training controls — phishing remains the single most common initial vector — and recommends that organizations pre-stage an incident-response retainer before an attack occurs.

How This Fits a Bigger August

The Medusa advisory lands in the same week Microsoft shipped its August Patch Tuesday fixing 421 vulnerabilities — including a Windows Ancillary Function Driver zero-day actively exploited by Lazarus-linked actors — and the same month LexisNexis confirmed an AWS-hosted breach that exposed roughly 364,000 profiles. With CISA's CVE Brief for August 18 listing 2 actively exploited vulnerabilities, 42 additional critical issues, and 95 high-priority updates, the Medusa advisory gives defenders one consolidated document for a threat actor that has been steadily climbing the priority list. The full PDF advisory is published at ic3.gov/CSA/2026/260818.pdf.