Medusa’s update: the theft was throttled to stay under your thresholds

On August 18, 2026, CISA, the FBI, and the Department of Health and Human Services republished their joint #StopRansomware advisory on Medusa, product ID AA25-071A. It is the first substantive revision since the original March 2025 release, and it folds in FBI investigative findings through April 2026. The headline number moved: the agencies now put Medusa at more than 500 victim organizations, up from more than 300, with affected industries given as medical, education, legal, insurance, technology, and manufacturing. Unlike most victim counts in ransomware coverage, this one comes from federal investigations rather than from a leak site, which makes it a figure rather than a boast.

The reason this update is worth reading in full is not the count. It is that the agencies published the actual commands, and those commands describe an attack that spends most of its working life inside file shares.

The advisory maps Medusa to ATT&CK T1135, Network Share Discovery, and notes that affiliates query shared drives to locate sources of information. The published commands are the ones any Windows administrator would recognize: net share, net use, and a net view of the local subnet with the output redirected into a text file. The fourth is a PowerShell walk of the data share directory, run recursively and forcibly, selecting link type and target so that symlinks and junctions are followed rather than skipped.

Nothing in that sequence is malware. There is no signature to match, no unusual binary to quarantine, and no network anomaly to flag. An attacker who has already obtained valid credentials is running built-in Windows tooling to answer a question the operating system is happy to answer: where is the data, and how do I get to it? The output is a map of the share estate written to disk, and building it costs almost nothing in noise.

The collection stage is where the update earns attention. Per the advisory, affiliates use Bandizip to build archives and Rclone to move data out to their own infrastructure. Rclone is renamed, its configuration file is renamed alongside it, and both are staged inside directories that already carry Windows Defender exclusions, so the tooling sits in a location the endpoint agent has been told to ignore.

Then look at the command line the agencies printed. It copies from a victim file-data path with thirty parallel transfer streams, thirty checkers, and thirty transfers. It includes an explicit extension list covering the ordinary business record: Word documents, PDFs, spreadsheets, CSVs, text files, archives, and images. It caps individual files at 500 MB. And it sets a transactions-per-second limit.

That last flag is the tell. A rate limiter has no benefit to an attacker in a hurry. Its only function is to keep the operation beneath whatever threshold is watching, which means the attacker has already assumed that something counts volume and has designed around it. Any control whose detection logic is "alert when egress exceeds N" is not an obstacle to this playbook. It is an input to it. Separately, the advisory attributes small-batch transfers over the RDP clipboard to credential files and registry hives rather than to documents, so the two mechanisms should not be confused: bulk documents go out through Rclone, deliberately paced.

Strip the incident down and the decisive activity is one identity enumerating every share it can reach, then reading a large fraction of the documents on those shares, filtered by extension, sequentially, at machine parallelism, at a speed chosen to look unremarkable. Every one of those reads is permitted. Every file opened is a file that account is allowed to open. The perimeter sees an authorized session. The endpoint sees approved binaries in an excluded folder. The egress monitor sees a rate below its threshold.

The vantage point that still resolves the picture is the file system itself, assessing read behavior per identity and per share against what that identity normally does. A finance account touching a handful of spreadsheets in a morning and the same account reading every document across six shares in an afternoon are not distinguishable by permission, and they are trivially distinguishable by behavior. In most environments those shares live on a NAS, which is why NAS ransomware protection has to mean detection in the data path rather than a hardening checklist applied once.

Two further notes worth taking from AA25-071A. The encryptor is pushed network-wide with legitimate administration tooling, and before encrypting it stops services tied to backup, security, databases, file sharing, and communication, then deletes shadow copies. Backups remain necessary and remain the wrong instrument for this half of the problem: they restore copies after the fact, and they neither see nor interrupt a read. And because the documents left before anything was encrypted, an organization without a per-operation record of which files were opened is left negotiating against an attacker’s account of its own haul. Immutable audit is what turns that from an argument into a query.