CISA: More than 300 critical infrastructure orgs attacked by Medusa ransomware

The Medusa ransomware gang, operating as a ransomware-as-a-service (RaaS), has attacked over 300 victims across critical infrastructure and multiple industries using phishing and exploitation of unpatched vulnerabilities (including CVE-2024-1709 and CVE-2023-48788). U.S. agencies warn affiliates and initial access brokers help obtain access while developers control ransom negotiations; the group runs a leak site, practices aggressive extortion (including reports of potential triple extortion), and has affected schools, municipalities, government agencies, and private sector organizations.