Medusa Ransomware Passed 500 Victims. What Managed Detection Response Actually Buys

What the updated Medusa advisory actually says#

On 18 August 2026, CISA, the FBI and the Department of Health and Human Services jointly refreshed advisory AA25-071A, the original #StopRansomware bulletin on Medusa first published in March 2025, as BleepingComputer reported the same week. The headline figure has more than doubled the earlier estimate: over 500 critical infrastructure organisations hit, up from the "over 300" named in last year's original advisory, per Infosecurity Magazine. That works out to roughly two hundred new confirmed victims added in about a year, a pace The Record counts precisely at "more than 200" over the twelve months before the update.

Read the number for what it is, not what a headline implies. The 500-plus count reflects the FBI's investigation as of April 2026, while the advisory itself only reached publication in mid-August, a gap The Record makes plain by noting no new victims have been added to Medusa's own leak site since April. This is a patient prowl of a group, not a species that hunts on headline day, and treating a four-month-old count as live is the first mistake a rushed briefing tends to make.

The scale of the victim count is not the only number moving. Help Net Security and The Record both flag the same tempo problem: Medusa's affiliates exploit newly disclosed vulnerabilities within 24 hours, sometimes before a public disclosure even lands, closing the gap between first foothold and full encryption to under a day in some cases. That detail surfaced the same week in a corner of the internet that usually beats the trade press to a fresh advisory by hours, not days.

That speed is the whole argument for a watching service rather than a quarterly scan. A team that reviews logs on Monday morning cannot catch a breach that starts and finishes over a Sunday night, and a scan scheduled for next quarter is no defence against a flaw disclosed this afternoon.

Why healthcare, defence and finance keep landing in the leak site#

Medusa does not choose targets by industry loyalty, it chooses them by exposure. The sectors CISA names, healthcare and public health, the defence industrial base, critical manufacturing, government services and facilities, information technology and financial services, share one trait: they run software they cannot easily take offline, patched on a slower schedule than the exploit that targets it, per Help Net Security.

The clearest cautionary tale sits in Mississippi. In April 2026, Medusa shut down the University of Mississippi Medical Center, the state's only children's hospital, its sole Level I trauma centre, its only Level IV neonatal intensive care unit and its only organ transplant programme, as The Record reported. One ransomware note took out four kinds of care an entire state had nowhere else to get.

Once inside, Medusa's affiliates move with tools any systems administrator would recognise as ordinary: PowerShell for reconnaissance, AnyDesk for remote hands, rclone to shift stolen files to Medusa's own servers, and Mimikatz to lift credentials straight from memory, according to Picus Security's technique-by-technique mapping of the advisory against the MITRE ATT&CK framework. The encryptor itself, a file named gaze.exe, finishes by deleting the shadow copies that would otherwise let a victim quietly restore its own files, closing the easy exit before the ransom note ever appears.

Then the clock starts. Medusa runs a double-extortion model: encrypt first, publish second, with a 48-hour window between the two. Paying roughly $10,000 in cryptocurrency buys one more day of silence before the leak site goes live, a mechanic Help Net Security lays out in detail. Two days is barely long enough to confirm which systems are actually affected, let alone convene a board and brief a regulator.

Why prevention alone keeps losing#

Every technique above defeats a defence built purely on stopping known bad files. PowerShell, AnyDesk and rclone are legitimate software wearing an attacker's intentions, so a signature-matching tool waves them through because, technically, none of them is malware. Catching that pattern needs a second pair of eyes watching behaviour, not just files, which is the entire premise behind managed detection response: assume something will slip the front gate, and staff the inside of the property around the clock rather than trusting the lock alone.

Managed detection response, decoded#

folkfox writes it as managed detection response here because that is the phrase buyers actually type into a search bar. Most vendors and analysts write it in full as managed detection and response, shortened to MDR. Whichever spelling lands on the page, the service itself is the same: a third party watches your environment around the clock, using its own detection technology plus its own analysts, and acts on what it sees rather than simply alerting you to it, per Rapid7's own explainer of the model.

MDR vs EDR vs XDR, without the acronym soup#

MDR vs EDR vs XDR is the comparison every procurement conversation eventually reaches, and CrowdStrike's own explainer draws the line cleanly: EDR is a technology, a tool that collects endpoint data and helps a team detect and respond to it themselves. Managed detection response takes that same technology and staffs it, adding round-the-clock human triage, threat hunting and guided or automatic response, per CrowdStrike. XDR extends the same logic sideways, correlating signals across endpoint, cloud, identity and email rather than the endpoint alone.

None of that tells you which managed detection and response providers are actually worth a signature, which is the harder, less glamorous question most vendor pitches skip entirely.

Choosing managed detection and response providers, and what it costs#

Every conversation about managed detection and response providers eventually becomes a conversation about ransomware protection services more broadly, and buyers use the two terms almost interchangeably even though they are not quite the same thing. Ransomware protection services is the wider umbrella, covering everything from backup and recovery to staff training. Managed detection response is the specific, always-on watching layer inside that umbrella, the part actively hunting for the PowerShell-and-rclone pattern described above before it becomes a headline.

Numbers like these are the vendor's own claims, not an independent audit, and every one of them belongs in the questions you put back to a shortlist rather than taken on faith. Sophos and CrowdStrike both publish theirs; a provider that will not is telling you something too.

Two respected reports read the ransom-demand trend in different directions this year, and the disagreement is instructive rather than sloppy. Sophos's "The State of Ransomware 2026", a survey of 2,158 IT and security leaders across 17 countries fielded by Vanson Bourne, found the median ransom demand actually falling, down 65% over two years to $698,000.

Coalition's own 2026 claims report, drawn from its own policyholders rather than a survey, found initial ransom demands surging 47% to an average over $1 million. Read side by side, a pattern emerges: the opening number keeps climbing, but negotiation, backup posture and faster containment pull the number victims actually settle for back down. That gap between the asking price and the closing price is exactly where managed detection response earns its budget line, by shortening the window an attacker has to make the asking price stick.

What ransomware protection services should actually include#

A credible quote for ransomware protection services should name, specifically: continuous monitoring across endpoint, identity and cloud, not endpoint alone, a documented response SLA measured in minutes rather than a marketing range, human escalation for anything a machine cannot resolve alone, and a tested backup and recovery plan that does not depend on the same network the ransomware just encrypted. Sophos's own data makes the stakes plain: average recovery cost is up 11% year on year to $1.7 million even as headline ransom demands soften, which means the bill increasingly sits in downtime and rebuild, not in the ransom itself.

How CrowdStrike managed detection response compares to an independent provider#

CrowdStrike managed detection response, sold under the Falcon Complete brand, is the platform-native option: the vendor that built the endpoint agent also staffs the SOC watching it, backed by up to $2 million in breach warranty coverage and a claimed median time-to-contain of one minute, according to CrowdStrike's own service page.

The trade-off is coverage: a platform-native provider watches its own platform best, so an organisation running a mixed stack, several clouds, a legacy identity system, an acquired subsidiary's own tools, often gets broader visibility from an independent managed detection and response provider built to ingest telemetry from anyone's stack. Neither is automatically the right answer. Both need the same evaluation questions asked before signature day.

Vetting a vendor without getting fooled by a demo#

The fox does not sign anything on the strength of a confident bark. It reads the tracks, the actual evidence a provider left behind on a previous prowl through someone else's network, before it ever trusts the den. A vendor questionnaire should do the same: ask for the timestamped proof behind every claim in the deck, not the confident adjective sitting on top of it.

Coalition's own claims data contains a cautionary pattern worth borrowing directly into that questionnaire: policies got denied not because a client lacked EDR, but because the agent had not checked in for weeks, was running in alert-only mode with nobody watching after hours, or simply was not installed on the one endpoint that got hit, even though the paperwork said "we have EDR on every endpoint," per Coalition's 2026 claims report. Ask a managed detection response provider to prove coverage, not just claim it.

Where this sits alongside the rest of the thicket#

This posture sits alongside two other watchpoints folkfox flagged the same week: prompt injection attacks learning to whisper in cipher at the model layer, and a patched VPN that still let a stolen session back in at the network edge. Different doors, same lesson: a patch closes a door, a watch tells you whether someone is still inside it.

For teams building a compliance-led pitch around this posture, folkfox's cybersecurity marketing practice and the wider SEO and GEO work that gets that pitch found both start from the same evidence-first standard: name the number, link the source, show the receipt. It is the same discipline behind folkfox's content marketing for regulated, security-adjacent buyers who read every claim looking for the seam where it might be padded.

Budget for managed detection response the way you would budget for insurance you actually expect to use: sized to the coverage gap it closes, proven against a real incident timeline, and reviewed the moment a provider's own numbers stop matching what your logs actually show. Sign nothing on the strength of a slide alone.

Frequently asked questions#