Medusa showed that a clinic’s remote-support software is its ransomware attack surface

The week

On March 12, 2025, CISA, the FBI and the Multi-State Information Sharing and Analysis Center published joint advisory AA25-071A on Medusa, a ransomware operation active since 2021 that had moved to an affiliate model. The agencies said Medusa had affected more than 300 victims in critical infrastructure sectors as of February 2025, including medical, education, legal, insurance, technology and manufacturing organizations. Affiliates got in through phishing and unpatched internet-facing software, naming flaws in ConnectWise ScreenConnect and Fortinet’s endpoint management server. Once inside, they used remote access products such as AnyDesk, Atera, ConnectWise, N-able, Splashtop and SimpleHelp, tried to disable endpoint detection with vulnerable drivers, and exfiltrated data with Rclone. Victims faced a leak site with a countdown timer. The agencies noted Medusa was unrelated to MedusaLocker or the Medusa mobile malware.

Read closely, the Medusa advisory is less a description of a gang than an inventory of the software hospitals and clinics use to support themselves. Remote-support agents, endpoint management servers and software deployment tools appear on almost every page. Each was built to give a trusted person control of a machine from somewhere else. Medusa’s affiliates simply stepped into that role. For a health system or ambulatory network, this reframes the defensive problem. Malware signatures matter less than how the organization governs its own administrative tooling. That tooling plays three distinct roles in an attack like this one, and each needs a different control: as the way in, as the way around, and as the cover for switching off defenses.

Entry: management products as the front door

Both vulnerabilities named in the advisory sit in management software. ScreenConnect is a remote-support product. Fortinet’s FortiClient EMS manages endpoint security agents. When either faces the internet unpatched, an attacker inherits a channel designed to reach every machine it manages. That is a far better starting position than a single phished laptop.

Healthcare carries more of these exposures than most sectors, and for structural reasons. Imaging modalities, laboratory analyzers and pharmacy systems often ship with vendor remote-support access. Physician groups acquired by a health system arrive with their own managed service provider and its tools. EHR consultants are given access during go-lives and sometimes never lose it. None of these paths was designed by the security team, and many are invisible to it.

The control is a single brokered route for third-party access. Vendors connect through a privileged access gateway that the health system owns, with named accounts, time-limited sessions, multifactor authentication and session recording. The advisory itself recommends requiring VPNs or jump hosts for remote access and filtering traffic so untrusted sources cannot reach internal remote services. The harder work is contractual. Device and software agreements should require vendors to use the organization’s gateway and forbid them from installing their own persistent agents. Clinical engineering, procurement and the CISO need to agree on that language before the next contract renewal, not after an incident.

Movement: legitimate tools as the attacker’s workforce

Once inside, Medusa affiliates installed or reused remote management products to move between machines and stage their payload. Endpoint tools rarely flag this. The binaries are signed, the vendors are reputable, and the same tools are legitimately present on other hosts. A clinic with five remote-support products in daily use offers an intruder five forms of camouflage.

Software deployment tools add a further layer. The advisory notes affiliates using products such as PDQ Deploy and standard utilities such as PsExec to push files and commands across many hosts at once. In a hospital, the same deployment console that pushes an EHR client update to every workstation can push an encryptor just as efficiently.

The defensive measure is to shrink that number deliberately. Pick one or two approved remote management products for the enterprise and block the rest. Application control, through Windows Defender Application Control or AppLocker policies, can prevent unapproved remote tools from running at all. Egress filtering can block connections to the cloud relay services those products use, except for the approved ones. A useful metric for the board is the count of distinct remote access products seen on endpoints each month, with a target the CISO commits to.

The trade-off is real. Device vendors write support terms around their preferred tool, and some will resist. Departments that rely on a particular product will push back when it disappears. Expect a period of exceptions, each with an owner and an expiry date. Without expiry dates, exceptions harden into the old sprawl.

Evasion: trusted access as cover for switching off defenses

The third role is the one most healthcare environments leave open. The advisory describes affiliates loading vulnerable or signed drivers to kill endpoint detection, disabling Microsoft Defender through local Group Policy, and placing tools such as Rclone in folders already excluded from antivirus scanning. Each technique turns administrative access into the means of blinding the security team.

Antivirus exclusions deserve particular attention in hospitals. EHR, imaging and laboratory vendors often request broad exclusions for performance, and those exclusions accumulate over years without review. An attacker who finds an excluded directory has a safe place to work. A quarterly review of exclusions, with each one tied to a documented vendor requirement, removes much of that cover.

Three further controls address the rest. Turn on Microsoft’s vulnerable driver blocklist and EDR tamper protection across the estate. Treat a sensor that stops reporting as a security incident, not a help desk ticket, because a silent agent is often the first sign of evasion. Watch for large outbound transfers to cloud storage, since Rclone exfiltration precedes the leak-site threat. That last control has a compliance dimension. If patient data leaves the network, a covered entity or business associate faces a HIPAA breach analysis even when backups restore every system. Organizations should work through notification decisions with counsel, but they need the telemetry first.

Across all three roles, the common thread is ownership. Someone has to be accountable for every route by which a remote party can control a clinical or business system. That person needs the authority to say no to a vendor.

With hindsight

The pattern the advisory described held through 2025 and into 2026. In June 2025, CISA warned that ransomware actors had exploited unpatched SimpleHelp remote management software to reach customers of a utility billing software provider. It was a direct case of a management tool serving as a supply chain door. CISA has since updated the Medusa advisory itself to add newer exploited flaws in file transfer and remote-support products, including Fortra GoAnywhere and BeyondTrust.

On the regulatory side, HHS’s January 2025 proposal to overhaul the HIPAA Security Rule, which would make asset inventories, multifactor authentication and segmentation explicit expectations, remained a proposal into late 2026. The federal regulatory agenda pushed final action out to 2027. Health systems that waited for the rule to force remote-access governance are still waiting. Those that consolidated their remote tools in 2025 did the work on their own timetable.