Medusa Ransomware Campaign Targets 40+ US School Districts

Tuesday, March 10, 2026 at 08:00 AM UTC·Source: FBI / CISA Joint Advisory

Updated: Wednesday, March 11, 2026 at 02:00 PM UTC

Executive Summary

Medusa ransomware group attacks over 40 US school districts via compromised RDP. Student and staff PII at risk. FBI issues sector-wide alert.

Analysis

Medusa ransomware has compromised over 40 US school districts through exposed or credential-stuffed RDP endpoints. Stolen data includes student records with grades, disciplinary actions, IEPs, and staff SSNs. FBI and CISA have issued a joint advisory with specific IOCs and mitigation guidance for the K-12 sector.

Timeline

Discovered

Mar 3, 2026

Exploitation Detected

Mar 3, 2026

Published

Mar 10, 2026

Source Attribution

Originally published by FBI / CISA Joint Advisory on Mar 10, 2026. Verified by: FBI, CISA, MS-ISAC.

Related Threats

CRITICALRansomware

Cisco fixes critical IMC auth bypass present in many products

Cisco has released patches for a critical vulnerability in its out-of-band management solution, present in many of its servers and appliances. The flaw allows unauthenticated remote attackers to gain admin access to the Cisco Integrated Management Controller (IMC), which gives administrators remote control over servers even when the main OS is shut down. The vulnerability, tracked as CVE-2026-2009

CVE-2026-20093

6h agoCSO Online

HIGHRansomware

Akira ransomware group can achieve initial access to data encryption in less than an hour

A new report from Halcyon finds that the group also puts more effort than usual into developing working decryptors, likely to incentivize businesses to pay up. The post Akira ransomware group can achieve initial access to data encryption in less than an hour appeared first on CyberScoop .

12h agoCyberScoop

CRITICALRansomware

vSphere and BRICKSTORM Malware: A Defender's Guide

<div class="block-paragraph_advanced"><p>Written by: Stuart Carrera</p> <hr/></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Building on </span><a href="https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

CVE-2026-22769

15h agoMandiant