Medusa ransomware persistence
Medusa operators continue ransomware activity across organizations using data theft and encryption pressure.
- Momentum score
- 69
- Impact
- High
- Confidence
- High
What it is
Medusa is a ransomware-as-a-service operation in which affiliates compromise organizations, steal data, encrypt systems, and threaten publication to increase pressure on victims. The ransomware was first identified in June 2021 and developed into a durable extortion operation rather than a short-lived campaign. Joint government reporting shows that activity continued through April 2026.
Why it is rising
The joint CISA, FBI, and HHS advisory records activity continuing through April 2026, demonstrating durable operational activity.
Six-month trajectory
Normalized weekly momentum for prototype validation
+12 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Use persistence over time to argue for measurable resilience, not campaign-of-the-month fear.
- 02Show how tested recovery and data controls address different extortion paths.
- 03Provide a cross-functional ransomware exercise for security and business leaders.