500 critical infrastructure victims, and almost none of them were hacked by anything exotic
In August 2026 CISA, the FBI and HHS updated their joint advisory on Medusa ransomware, and the headline number moved from "over 300" victims in March 2025 to over 500 critical infrastructure organisations. Healthcare, defence industrial base, critical manufacturing, government, IT and financial services all show up on the list. What should worry infrastructure owners is not the count. It is how unremarkable the attacks were.
Medusa did not need a nation-state zero-day to reach 500 organisations. The group bought stolen credentials from access brokers, walked in through an unpatched internet-facing appliance, and then did most of its damage using the exact administrative and remote-access tools the victims had already installed. We have spent 25 years building and defending banking, telecom and critical-infrastructure environments, and this pattern is the one we see in almost every ransomware post-incident review: the technical entry point is boring, and the reason it worked is organisational.
Why the victim count keeps climbing: the ransomware supply chain
Medusa runs as ransomware-as-a-service. There is a core group that maintains the malware and the leak site, and there are affiliates who do the actual break-ins in exchange for a cut. To feed those affiliates, Medusa recruits initial access brokers on criminal forums, advertising bounties reported to run from a few hundred dollars up to a million for exclusive access to a target network.
That structure is the whole story behind the 500 number. When breaking in, moving laterally and deploying the payload are separate specialised jobs handled by different people, the operation scales the way any well-run business does. A defender is no longer up against one attacker who has to be good at everything. They are up against a division of labour. The person who phished your credentials never has to know how to run the encryption; they just sell what they stole to someone who does.
Two consequences follow. First, the barrier to being targeted is low, so "we are too small or too obscure to be interesting" is not a defensible assumption. If your VPN credentials are for sale, you are interesting. Second, the initial access is often days or weeks old by the time encryption happens, which means there is a detection window most organisations never use.
The blind spot: attackers logging in with your own tools
The most useful detail in the advisory, and the one that changes how you defend, is the tooling. Medusa's initial access came largely from phishing for credentials and from two specific edge vulnerabilities: CVE-2024-1709, the ScreenConnect authentication bypass, and CVE-2023-48788, the SQL injection flaw in Fortinet's FortiClient EMS. Both are internet-facing, both had patches available, and both were exploited well after those patches shipped.
Once inside, the group leaned on legitimate software. For hands-on-keyboard access they abused mainstream remote monitoring and management tools: AnyDesk, Atera, ConnectWise, eHorus, N-able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop. For reconnaissance they used Advanced IP Scanner and SoftPerfect Network Scanner. Credentials came out of memory with Mimikatz. Lateral movement and payload deployment rode on PsExec and BigFix. Data left the building through Rclone. Ingress and enumeration happened through PowerShell, the Windows command prompt and Certutil.
None of that is malware in the signature-scanning sense. This is living off the land, and it is effective precisely because a RMM agent connecting to a workstation, or PowerShell pulling a file, is indistinguishable from normal IT operations unless you have baselined what normal looks like. Endpoint protection that only asks "is this file known-bad?" will wave most of it through.
The RMM problem, stated plainly
Here is the table we walk clients through when they ask why their antivirus did not catch it. The left column is what the tool is for. The right column is what the same tool does in an intrusion. It is the same binary either way.
Tool categoryLegitimate useUse in a Medusa-style intrusion
RMM agents (AnyDesk, ConnectWise, Atera, Splashtop)
Help-desk remote support, patch deployment
Persistent remote access that survives reboots and blends into IT traffic
PsExec, BigFix
Remote administration, software rollout
Lateral movement and pushing the encryptor to many hosts at once
PowerShell, Certutil
Automation, certificate handling
Downloading payloads and running commands without dropping obvious malware
Rclone
Syncing files to cloud storage
Bulk exfiltration of data before encryption for double extortion
Mimikatz, network scanners
Security testing (Mimikatz), asset discovery
Harvesting credentials and mapping the network for the next hop
If your monitoring cannot tell the difference between your help desk using Splashtop and an intruder using Splashtop, that is the gap the affiliate is counting on.
How the attack actually unfolds
Ransomware feels sudden because the encryption is sudden. The intrusion behind it is not. It runs as a sequence, and every stage in that sequence is a chance to break the chain before the ransom note appears. The diagram below maps the Medusa progression against the control that interrupts each step.
The point of drawing it this way is that no single control has to be perfect. Defence works because the attacker has to clear every hurdle, and you only have to stop them at one. An organisation that patches its edge, enforces phishing-resistant MFA, segments its network and keeps immutable backups has four independent chances to end the incident before it becomes a disaster. Most victims had zero, because their whole strategy rested on prevention at the perimeter.
Why critical infrastructure and OT make this harder
The sectors on the Medusa list are not random. Healthcare, manufacturing and utilities run operational technology alongside their IT, and OT changes the risk calculus in ways that reward attackers. A programmable logic controller or a hospital imaging system cannot be patched on Patch Tuesday. It runs an operating system the vendor certified years ago, it often cannot tolerate the reboot, and taking it offline may mean stopping a production line or a clinical service.
The result is a large population of unpatchable, long-lived systems sitting on networks that were originally designed for availability, not for containment. When IT and OT share flat network space, an intrusion that starts on a finance laptop can reach a plant floor. The industry commentary around this advisory put the blame on a lack of threat awareness inside OT teams, and there is truth to that, but the deeper issue is architectural. OT was engineered on the assumption that the network around it was trusted. That assumption stopped being safe a long time ago.
This is where segmentation stops being a best-practice checkbox and becomes the single most valuable investment. If the OT environment is properly isolated, with a monitored boundary between it and the corporate network, a ransomware event in IT stays in IT. If it is flat, one compromised credential can put a whole operation on the leak site.
The controls that actually break the chain
CISA's mitigation list maps cleanly onto NIST CSF and the CIS Critical Security Controls, which is what we anchor client roadmaps to. The four below are the ones that would have stopped or contained the majority of Medusa intrusions we have reviewed.
Identity: make phishing-resistant MFA the default
Medusa's primary entry method was stolen credentials, so identity is the first and highest-value control. Requiring multifactor authentication on everything internet-facing, particularly webmail, VPN and any account that touches critical systems, is non-negotiable. But not all MFA is equal. Push-notification MFA is vulnerable to fatigue attacks, where the attacker spams approval prompts until a tired user taps accept. Where the account matters, move to phishing-resistant methods: FIDO2 security keys or passkeys, which cannot be relayed or approved by accident. CISA also recommends long passwords and, notably, dropping the old habit of forced frequent rotation, which just pushes users toward predictable patterns.
Attack surface: patch the edge like it is on fire
The two named CVEs were both in internet-facing appliances, and both were patchable. Edge devices, VPN concentrators, remote-access gateways and management interfaces are where ransomware affiliates shop first, because a single unpatched appliance is a clean way in that bypasses the endpoint fleet entirely. Internal patching can follow a normal cadence. Internet-facing systems need an emergency lane, measured in days, not the next maintenance window. Maintaining an accurate inventory of what you actually expose is half the battle; you cannot patch an appliance you forgot you had online.
Segmentation and least privilege: assume they will get one machine
Plan for a compromise, not against one. Segment networks so that lateral movement is slow and noisy rather than instant. Put the OT environment behind a monitored boundary. Disable unused ports and filter untrusted traffic to internal remote services. On the identity side, audit every account with administrative privileges and cut it back to least privilege, because the difference between one encrypted workstation and an encrypted estate is usually a domain admin credential the attacker should never have been able to reach.
Backups you can actually restore from
Every ransomware defence eventually comes down to one question: can you recover without paying? Medusa runs double extortion, encrypting your data and threatening to leak the copy they already exfiltrated, so backups do not solve the extortion problem entirely. But they take encryption off the table as leverage, and that changes every negotiation. CISA is specific here: keep multiple copies in a physically separate, segmented, secure location, and make sure backup data is encrypted, immutable, and covers the whole infrastructure. Immutable is the operative word. If your backups sit on a share that a domain admin credential can reach and delete, the attacker will delete them before triggering encryption. We have watched it happen.
The practical shape of this is the 3-2-1-1-0 rule, which extends the classic backup guidance for the ransomware era.
The last two digits are the ones organisations skip and later regret. One offline or immutable copy is what survives an attacker with domain admin. Zero errors means you have actually tested a restore recently, at scale, against a realistic recovery-time objective, rather than assuming the backup job's green checkmark means the data will come back.
A readiness checklist
If you want a concrete starting point, this is the sequence we run with clients, ordered by impact against the Medusa playbook specifically.
- Inventory every internet-facing system and confirm each one is patched, with an emergency patch lane for edge appliances measured in days.
- Enforce MFA on all external access, and upgrade to phishing-resistant MFA (FIDO2, passkeys) for administrators and anyone touching critical or OT systems.
- Audit administrative accounts and reduce them to least privilege; remove standing domain admin rights where they are not essential.
- Inventory the RMM and remote-access tools legitimately in use, block all others at the endpoint, and alert on any new one appearing.
- Segment the network, isolate OT behind a monitored boundary, disable unused ports and filter access to internal remote services.
- Move backups to an immutable, offline-capable design following 3-2-1-1-0, and prove recovery with a timed restore test.
- Establish behavioural monitoring that baselines normal use of PowerShell, PsExec and RMM tools so anomalous use is visible.
- Write and rehearse an incident response plan that assumes the intruder is already inside, including who decides, who communicates, and how you operate with systems down.
Work top to bottom. The first three items address how Medusa gets in, the next two address how it spreads, and the last three address how you survive and detect it.
How Aydahwa Enterprise can help
Aydahwa Enterprise builds and defends the kind of environments Medusa targets. Our work is grounded in recognised frameworks, ISO 27001, PCI-DSS, SOC 2, the NIST Cybersecurity Framework and the CIS Benchmarks and Controls, and in hands-on experience across banking, telecom and critical national infrastructure, where downtime and data loss carry regulatory and safety consequences, not just inconvenience. Our lead architecture holds the Microsoft Cybersecurity Architect Expert certification, and we design controls to fit the resources an organisation actually has rather than an idealised budget.
If you want to know where you stand against a ransomware playbook like this one, start with our free cyber security self-assessment and the cybersecurity readiness checklist. For hands-on work, our cybersecurity services cover identity hardening, segmentation and ransomware readiness reviews; our cloud services team handles secure architecture, immutable backup design and recovery testing; and our managed IT support keeps the patching, monitoring and RMM governance running so the gaps that let Medusa in never open in the first place. When you are ready to talk specifics, get in touch.
