![T500定制 (72) [轉換]-01.png](https://static.wixstatic.com/media/b6f49f_9a6c8a5984ed433aa6c1479d8a92f5ff~mv2.png/v1/fill/w_631,h_422,al_c,q_85,usm_0.66_1.00_0.01,enc_avif,quality_auto/b6f49f_9a6c8a5984ed433aa6c1479d8a92f5ff~mv2.png)
Medusa Ransomware Has Hit More Than 500 Organizations: Securing the Perimeter Is Not Enough
Patching matters—but so does stopping attackers from moving freely once they get in
A new CISA update says Medusa ransomware has affected more than 500 organizations across healthcare, manufacturing, government, and other critical sectors. Janus explains how microsegmentation and least privilege can contain lateral movement. On August 18, 2026, CISA, the FBI, and HHS updated their joint advisory. As of April 2026, Medusa-linked actors had affected more than 500 organizations across healthcare, government, defense, critical manufacturing, IT, financial services, and other sectors.
What happened: More than 500 organizations affected
On August 18, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) updated their joint advisory on Medusa ransomware. The update says that, as of April 2026, Medusa-linked actors had affected more than 500 organizations. The earlier March 2025 advisory had cited more than 300 victims, showing that the campaign remained active and continued to expand.
The affected sectors include healthcare and public health, government facilities, defense industrial base organizations, critical manufacturing, information technology, financial services, chemicals, communications, energy, food and agriculture, transportation, and water systems. This does not mean every incident caused a production shutdown, but it does show that the risk spans environments where system availability, legacy equipment, and operational continuity all matter.
The agencies recommend patching known vulnerabilities, segmenting networks, and restricting access to remote services. Those are important steps. The larger lesson, however, is that ransomware defense cannot end at the perimeter. Organizations also need to prepare for what happens after an attacker gains an initial foothold.
Attackers move fast—and start looking for paths through the network
Microsoft has separately tracked a threat actor known as Storm-1175 that deploys Medusa ransomware. In observed cases, the actor exploited known, already-patched vulnerabilities—often called N-day vulnerabilities—to gain access. Microsoft found that the actor may begin lateral movement within days and, in some cases, in less than 24 hours.
After entry, the actor has used local or domain accounts, remote monitoring and management tools, stolen credentials, RDP, PsExec, PowerShell, PDQ Deploy, Group Policy, and Rclone to discover assets, expand access, exfiltrate data, and deploy ransomware. The combination of encryption and data theft supports a double-extortion model: victims may face both operational disruption and the threat of public disclosure.
These observations apply to Storm-1175 and should not be treated as a complete description of every Medusa intrusion or all 500 affected organizations. Public reporting does not fully disclose each victim’s initial access path, outage duration, or data loss, so those details should not be inferred.
The real danger is not one compromised system—it is the rest of the environment
An initial compromise does not automatically become a major outage. The outcome depends on how easily the attacker can reach identity systems, file servers, backups, engineering workstations, administrative services, and the connections between IT and OT environments.
When internal connectivity is too permissive, one compromised asset can become a launch point. The challenge is harder because attackers often use legitimate accounts and administration tools. Their activity can blend into normal operational traffic until the damage is already underway.
Patching remains essential, but it is not enough by itself. Organizations also need to reduce unnecessary trust and reachability inside the network. In production, healthcare, and critical-infrastructure environments, that control must be introduced carefully so that security changes do not disrupt essential operations.
Janus perspective: Assume the perimeter may fail and reduce internal exposure
A practical response starts with three actions:
1. Understand real internal communications.
Identify which assets communicate, which services they use, and whether those paths are actually required. This provides the evidence needed to distinguish normal operations from unnecessary exposure.
2. Apply least privilege to east-west traffic.
Limit systems to the connections they need for their role. If an endpoint is compromised, unnecessary access to servers, peers, and administrative zones should not remain open by default.
3. Roll out policy changes in stages.
Use observed communication patterns to validate policies before enforcing them. A phased approach helps reduce operational risk, especially where legacy devices and fragile applications cannot tolerate abrupt network changes.
How netKeeper can help: From communication visibility to least privilege
Janus Cyber’s netKeeper is designed to help organizations discover assets and communication relationships, visualize network paths, and define least-privilege microsegmentation policies. This can support a more controlled approach to limiting lateral movement and reducing the potential blast radius of a compromised device.
For teams managing mixed IT, OT, legacy, and specialized-device environments, the value is not simply adding more rules. It is reducing the manual effort required to understand dependencies and making policy changes with better context. netKeeper is one layer in a broader defense-in-depth strategy; it does not replace patching, identity security, endpoint protection, backups, monitoring, or incident response.
Conclusion: Ask not only whether attackers can get in, but how far they can go
The Medusa update is a reminder that ransomware risk is not limited to one industry or one vulnerability. Once attackers gain access, speed and internal reach can determine whether the incident stays contained or becomes a business-wide crisis. The more useful security question is therefore not only, “Can we keep attackers out?” but also, “If they get in, how far can they go?”
Want to know which connections in your environment could enable ransomware to spread laterally? Talk to Janus Cyber about starting with asset communication mapping and a least-privilege assessment.
CISA / FBI / HHS｜#StopRansomware: Medusa Ransomware（Updated August 18, 2026)
Microsoft Threat Intelligence｜Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations（2026/04/06）
This article is based on verified public advisories and Microsoft’s observations of a specific threat actor. Individual intrusion paths, outage duration, and data loss have not been fully disclosed, so we do not speculate about them. The product section reflects Janus Cyber’s defensive recommendations and does not imply that netKeeper was deployed in any affected environment.
