The Medusa ransomware operation has impacted over 300 critical infrastructure organizations in the U.S. as of February 2025, according to a joint advisory by the U.S. Cybersecurity and Infrastructure Security (CISA), the Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC). Active since 2021, Medusa gained traction in 2023 with the launch of its leak site and later evolved into a Ransomware-as-a-Service (RaaS) model, recruiting affiliates and paying up to $1 million for access to victims. The operation has claimed over 400 victims globally, targeting industries such as healthcare, education, and manufacturing. High-profile attacks include Minneapolis Public Schools and Toyota Financial Services, with ransom demands reaching $8 million. Medusa attacks surged 42% from 2023 to 2024 and nearly doubled in early 2025. Authorities urge organizations to patch vulnerabilities, segment networks, and filter untrusted traffic to mitigate threats. Confusion exists around the Medusa name due to its association with other malware variants, but this ransomware is distinct from MedusaLocker.