[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOVlgU1Yu0GWPvYHNDVysvm7y9gfgEDlcrMhauDZ6GXU":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"93013eda-5c2d-4b76-b11e-ea37b89ef144","CISA: Medusa ransomware hit over 500 critical infrastructure orgs","cisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs-5ef6f1","The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. [...]","The Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021, according to a joint advisory from CISA, HHS, and the FBI. The advisory updates a previous report from March 2025, which indicated over 300 victims. Medusa operates as a Ransomware-as-a-Service (RaaS) and has been active since January 2021, escalating its activity in 2023 by using stolen data for ransom leverage.","Medusa ransomware has impacted over 500 critical infrastructure organizations in the US since June 2021.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F19\u002FMedusa-headpic.jpg","2026-08-19T08:00:48+00:00","2026-08-19T10:00:21.771823+00:00",8,[17],{"name":18,"type":19},"Medusa","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":20,"icon":22,"name":23,"slug":24},null,"Ransomware","ransomware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":129},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":72,"name":73,"problem":74,"products":75},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":101,"name":102,"problem":103,"products":104},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":148},"medusa-ransomware-breaches-500-critical-infrastructure-orgs","Medusa Ransomware Breaches 500+ Critical Infrastructure Orgs","The Medusa ransomware gang has compromised over 500 critical infrastructure organizations by exploiting unpatched vulnerabilities and leveraging stolen credentials, operating as a Ransomware-as-a-Service (RaaS) model that lowers the barrier for attackers. The escalating victim count — from 300 to 500+ in just months — signals that affected sectors are failing to implement adequate defensive controls in time. Medusa's use of stolen data as additional ransom leverage (double extortion) amplifies the damage beyond operational disruption to include serious data breach exposure. Critical infrastructure organizations face heightened responsibility because disruptions can cascade into public safety risks, making resilience and rapid response not just best practice but a societal imperative.",[135,136,137,138,139,140,141,142,143,144,145,146,147],"CISA KEV (Known Exploited Vulnerabilities Catalog)","NIST CSF 2.0 - RC.RP (Recovery Planning)","NIST SP 800-61 - Incident Response","NIST SP 800-34 - Contingency Planning","CIS Control 7 - Continuous Vulnerability Management","CIS Control 11 - Data Recovery","CIS Control 12 - Network Infrastructure Management","CIS Control 17 - Incident Response Management","NIST AC-2 - Account Management","NIST IA-5 - Authenticator Management (MFA)","NIST SI-3 - Malicious Code Protection","HIPAA Security Rule 45 CFR § 164.308(a)(7) - Contingency Plan","NERC CIP-009 - Recovery Plans for BES Cyber Systems",{}]