Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

The Medusa ransomware group is aggressively targeting organizations that fail to patch known vulnerabilities in widely-used enterprise tools like Fortra GoAnywhere and BeyondTrust, sometimes exploiting flaws within a single day of public disclosure. Their use of access brokers further lowers the barrier to entry, allowing them to scale attacks rapidly across sectors, with healthcare being a primary target. This highlights a critical gap in many organizations' patch management and vulnerability response programs — the window between vulnerability announcement and exploitation is shrinking dramatically. Delaying patches even by days can be the difference between a secured environment and a ransomware incident with severe operational and regulatory consequences.