On 18 August 2026, the FBI, CISA and the U.S. Department of Health and Human Services updated joint advisory AA25-071A. The headline figure: as of April 2026, Medusa ransomware developers and affiliates have impacted over 500 victims across critical infrastructure sectors. Seventeen months earlier, the same advisory counted 300. That growth rate — roughly one new critical infrastructure victim every three days — sets the backdrop for the practical question this article addresses: does your NIS 2 resilience plan survive contact with a Medusa attack?
What Medusa is and how it operates
Medusa is a ransomware-as-a-service (RaaS) operation first identified in June 2021, which shifted to an affiliate model around 2023. Core developers manage the platform and handle ransom negotiations; affiliates carry out intrusions and receive a share of successful ransoms. The August 2026 advisory update focuses specifically on the Healthcare and Public Health sector, but the full victim list spans defence, critical manufacturing, government facilities, information technology and financial services.
Initial access comes through three main routes: purchase of credentials from initial access brokers (brokers receive between $100 and $1 million USD per sale), phishing campaigns, and exploitation of unpatched internet-facing systems. Named vulnerabilities include a ScreenConnect authentication bypass (CVE-2024-1709), a Fortinet FortiClient EMS SQL injection (CVE-2023-48788), a BeyondTrust remote code execution (CVE-2026-1731) and Fortra GoAnywhere deserialization flaws. The common denominator is a perimeter service left unpatched — not a sophisticated zero-day, but a known flaw with a public exploit and a known remediation that was never applied.
The step that breaks your resilience plan: destroying recovery infrastructure
Once inside, Medusa affiliates use living-off-the-land techniques — PowerShell, cmd.exe, WMI — and legitimate remote monitoring tools such as AnyDesk, SimpleHelp, Mesh Agent and Atera for lateral movement and persistence. Credential dumps from LSASS memory using Mimikatz provide elevated privileges. Rclone stages data for exfiltration before encryption begins.
The technical detail most directly relevant to your resilience posture is what happens immediately before the ransomware payload runs: Medusa terminates backup processes and deletes Volume Shadow Copies. This is not accidental. Destroying VSS is a calculated attack on your ability to recover without paying. If your resilience plan depends on VSS-based snapshots or on backup agents running as services the toolchain can identify and kill, your offsite backup window is the only question left that matters.
After destroying recovery options, Medusa encrypts files using AES-256 and appends the .medusa extension to each one.
The double-extortion model and what it triggers under NIS 2
Ransom demands reach up to $15 million, with an average reported payout of approximately $260,000. But the financial figure is only part of the NIS 2 exposure. Because data is exfiltrated before encryption, two distinct obligations apply even if you successfully restore from backup.
Incident reporting: NIS 2 requires a significant incident to be reported to your competent national authority within 24 hours (early warning), a full notification within 72 hours, and a final report within one month. A Medusa attack that exfiltrates personal data triggers that clock regardless of whether you pay or recover cleanly. Missing the 24-hour window is itself a reportable failure.
Personal liability of management: Article 20 makes senior management personally accountable for security measures. Where an organisation cannot demonstrate it implemented proportionate risk management — including tested backup procedures, documented recovery time objectives and a real business continuity plan — that accountability is not theoretical.
A group operating under a dark-web leak portal, publishing stolen data if no payment arrives within 48 hours, also creates a secondary pressure to pay that exists entirely outside the technical recovery question.
What the advisory recommends, mapped to NIS 2 obligations
The FBI/CISA mitigations align directly with what NIS 2 enforcement bodies will look for. The most critical ones:
Offline, immutable backups: Backups must be stored off the network, tested regularly and protected against modification or deletion by any account the attacker could reach. The advisory explicitly flags that Medusa affiliates target and destroy backup infrastructure as a standard intrusion step, not an optional one.
Patching within 72 hours for known exploited vulnerabilities: CISA's Known Exploited Vulnerabilities (KEV) catalogue is the reference. The vulnerabilities Medusa uses most often — ScreenConnect, Fortinet, BeyondTrust — were all in KEV before these attacks. An organisation that had applied patches within 72 hours of KEV listing would have closed the entry points most frequently used.
Phishing-resistant MFA on all internet-facing services and privileged accounts: Medusa affiliates purchase credentials as a commodity. MFA susceptible to token theft — SMS codes, push notifications vulnerable to fatigue attacks — is insufficient for high-value accounts.
Network segmentation: Lateral movement across flat networks is a documented feature of every documented Medusa intrusion. Segmentation does not prevent compromise; it limits the blast radius.
Incident response plan, tested: Not documented — tested. A tabletop exercise run once two years ago is not a tested plan. A tested plan is one where your team has run the scenario, measured the time to detection and containment, and compared it against the recovery time objective you have committed to.
A vulnerability assessment conducted from an attacker's perspective will identify the unpatched internet-facing services that serve as Medusa's most common entry points. Combined with a review of your recovery architecture and business continuity documentation, a security audit adds direct value here. The NIS 2 and DORA checklist provides a structured starting point for organisations mapping their current posture to their regulatory obligations.
The question to answer this week
Not "are we compliant with NIS 2" — that is a documentation exercise. The operational question is: if Medusa affiliates gain access to one endpoint today, can you contain the intrusion before VSS is deleted, and can you restore critical services within the recovery time objective you have committed to? If you cannot demonstrate both with evidence, your resilience plan is a document, not a capability.
This article is general information, not legal or regulatory advice. NIS 2 obligations depend on your sector, size and the national legislation transposing the directive in your jurisdiction.
Sources: FBI/CISA/HHS Advisory AA25-071A, updated 18 August 2026; BleepingComputer, 19 August 2026; CybersecurityNews; IT Pro. Figures for ransom demands and victim counts are as reported by BleepingComputer and CybersecurityNews citing the joint advisory and FBI/IC3 data; treat them as reported rather than independently verified.