Critical infrastructure ransomware warnings escalate in August 2026

As of August 20, CISA, the Department of Health and Human Services and the FBI have issued an updated advisory saying the Medusa ransomware-as-a-service group has claimed more than 500 critical infrastructure victims. On August 10, CISA and the FBI joined with the Department of Defense Cyber Crime Center, the National Security Agency, the Secret Service and South Korea's National Police Agency to warn that Gunra ransomware actors are targeting critical infrastructure organizations worldwide. The warnings describe a model in which affiliates use ready-made tools, steal data and encrypt systems, and threaten to publish the data unless victims pay within days.

The timeline

Medusa emerged in June 2021 as a closed group, became a ransomware-as-a-service operation in early 2023, and launched a data leak site that year. In February 2024, the Russian-speaking BlackCat/ALPHV group attacked Change Healthcare, exposing 192 million records in what Think Global Health called the most consequential U.S. health care cyberattack. The FBI's 2025 internet crime report counted 460 ransomware attacks against U.S. health care, more than any other critical infrastructure sector and ahead of critical manufacturing's 355. A March 2025 advisory counted more than 300 Medusa critical infrastructure victims between 2021 and February 2025. Gunra first emerged in spring 2025 using leaked Conti ransomware source code. Ransomware.Live data cited by The Hacker News shows Gunra listed 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand and Hong Kong, with only three in the U.S. and Canada. By early 2026 it advertised a structured RaaS affiliate program on dark web forums. In March 2026, an Iranian-backed group called Handala attacked medical device maker Stryker; patient impact was minimal, but the incident showed the potential for severe care delays. On August 6, Mozambique's National Institute of Information and Communication Technologies and UNODC launched #AlertaRansomware, a campaign to strengthen defenses and reporting, with materials distributed to 25 institutions.

Gunra exploits Fortinet flaws and bypasses MFA

The August 10 advisory says Gunra affiliates exploit two authentication bypass flaws in Fortinet FortiOS and FortiProxy: CVE-2024-55591 and CVE-2025-24472. CVE-2024-55591 was disclosed in January 2025 as an exploited zero-day; CVE-2025-24472 was disclosed in February 2025 and added to CISA's known exploited vulnerabilities catalog about a month later. Gunra uses double extortion and threatens to publish stolen data if a ransom is not paid within five to seven days. The FBI observed Gunra altering a corporate VDI authentication portal to accept a specific one-time password value, bypassing multi-factor authentication. South Korean firm AhnLab said Gunra and a state-sponsored group appear separate but may have shared tools or collaborated to a limited extent.

Medusa update and exploitation speed

According to The HIPAA Journal on August 20, the August 2026 advisory says Medusa has now claimed more than 500 victims, with more than 200 of those in the past year. Medusa recruits initial access brokers and pays between $100 and $1 million for network access. The group quickly exploits newly announced vulnerabilities, sometimes within 24 hours or even the week before announcement. Health care is among its frequent targets.

What defenders should check

Agencies consistently recommend patching internet-facing vulnerabilities in VPNs and firewalls, segmenting networks, and maintaining immutable offline backups. In Mozambique, the August 6 #AlertaRansomware campaign aims to improve reporting and prevention across 25 institutions. The joint advisories show ransomware as a service has lowered barriers for affiliates and put critical infrastructure under sustained pressure.