[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIwL_37xXZr_usJLUveO6FzaJ5WCOfudnPFTXnPU6h1o":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2ce51b32-9410-4907-a0da-23684c80cfa2","Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics","medusa-ransomware-tallies-hundreds-of-new-victims-says-updated-advisory-on-group-b62248","The updated warning from the FBI, CISA and HHS draws on a year’s worth of investigations to detail how the group gains initial access and what it does afterward. The post Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics appeared first on CyberScoop.","The Medusa ransomware group has expanded its operations, adding hundreds of new victims by employing access brokers and rapidly exploiting software vulnerabilities, including those in Fortra GoAnywhere and BeyondTrust. The U.S. government advisory highlights Medusa's opportunistic approach, targeting unpatched systems and leveraging new exploits within 24 hours of their announcement, with a particular focus on the Healthcare and Public Health sector.","Medusa ransomware group uses access brokers and exploits vulnerabilities, targeting hundreds of victims.","https:\u002F\u002Fcyberscoop.com\u002Fmedusa-ransomware-tactics-cisa-advisory\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F08\u002FGettyImages-2240720331.jpg","2026-08-18T17:18:58+00:00","2026-08-18T18:00:23.850809+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Medusa","threat_actor",{"name":21,"type":22},"Fortra","vendor",{"name":24,"type":25},"GoAnywhere","product",{"name":27,"type":22},"BeyondTrust",{"name":29,"type":22},"Microsoft",{"name":31,"type":22},"Symantec","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[29,21,27],{"controls":58,"vendors":141},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,100,108],{"vendor_slug":94,"vendor_name":29,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":54,"name":117,"problem":118,"products":119},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[142],{"slug":143,"name":27,"logo_path":144,"roles":145},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[146],"affected",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":161},"medusa-ransomware-exploits-unpatched-systems-within-24-hours-of-disclosure","Medusa Ransomware Exploits Unpatched Systems Within 24 Hours of Disclosure","The Medusa ransomware group is aggressively targeting organizations that fail to patch known vulnerabilities in widely-used enterprise tools like Fortra GoAnywhere and BeyondTrust, sometimes exploiting flaws within a single day of public disclosure. Their use of access brokers further lowers the barrier to entry, allowing them to scale attacks rapidly across sectors, with healthcare being a primary target. This highlights a critical gap in many organizations' patch management and vulnerability response programs — the window between vulnerability announcement and exploitation is shrinking dramatically. Delaying patches even by days can be the difference between a secured environment and a ransomware incident with severe operational and regulatory consequences.",[152,153,154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIST SP 800-61: Computer Security Incident Handling Guide","HIPAA 45 CFR § 164.308(a)(5): Security Awareness and Training","CISA KEV (Known Exploited Vulnerabilities) Catalog","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities",{}]