Medusa Ransomware Surges As FBI Share Insight

**Executive Summary:** The FBI and CISA advisory, corroborated by Cyble data, describes a sharp increase in Medusa RaaS activity in early 2025 (60 victims in the first 72 days; 414 total recorded attacks), with frequent targeting of critical infrastructure sectors; the report documents TTPs including phishing, exploitation of known CVEs (e.g., CVE-2024-1709, CVE-2023-48788), living-off-the-land and legitimate remote management tools, common scanned ports and remote access methods, and provides IoCs (ransom note filename and two file hashes), concluding with prioritized defensive measures such as patching, phishing training, segmentation, and ransomware-resistant backups.