The CISA Publishes a Report on the Medusa Ransomware Gang

Active since 2021, the cybercriminal group has targeted over 300 critical entities worldwide, including municipalities in France.

The CISA, the U.S. equivalent of France’s Anssi, and the FBI published a report on March 12, 2025, about the Medusa ransomware gang. Emerging in 2021, the cybercriminal group has attacked at least 300 critical entities worldwide, including numerous public organizations.

Medusa notably hacked educational institutions in Minneapolis in 2023, exposing sensitive information on more than 100,000 students. The gang has also targeted municipalities in France, public organizations in Illinois and Texas, government agencies in the Philippines, state IT systems in Tonga, and a technology company in Canada.

Initially operating as a closed group, Medusa later transitioned to a Ransomware-as-a-Service (RaaS) model, involving affiliates. According to the report, the gang’s attacks are “relatively basic” and rely on phishing, exploiting unpatched vulnerabilities, or using initial access brokers.

Medusa typically contacts its victims immediately after an attack, giving them 48 hours to pay a ransom. After this period, gang negotiators often reach out to the targeted entity’s executives to persuade them to comply with the ransom demand.