Medusa and UMMC: The Clinic That Learned to Run Offline

The University of Mississippi Medical Center is not one hospital among many. It is the state's only children's hospital. Its only Level I trauma center. Its only Level IV NICU. Its only transplant program. Ten thousand employees. When UMMC stops, Mississippi has no second option.

On 19 February 2026, it stopped. Thirty-five clinical sites closed until 2 March.

The origin

Medusa has run as Ransomware-as-a-Service since June 2021. In their joint advisory with MS-ISAC, CISA and the FBI take the trouble to spell out something that reads like pedantry and isn't: Medusa is distinct from MedusaLocker and distinct from the mobile malware also called "Medusa." Three different things, one name. Confusing them means reaching for the wrong countermeasures.

On 12 March the group claimed UMMC on its leak site: $800,000, deadline 20 March, plus $100,000 to extend by a week. Around the same time Medusa also claimed Passaic County, New Jersey for the identical sum. And UMMC is the fourth Mississippi hospital system hit in three years — not an isolated incident but a regional pattern.

1. 19 February 2026
   The attack

   UMMC stops: thirty-five clinical sites closed.

2. 2 March
   The reopening

   The clinical sites stay shut until this date.

3. 12 March
   The claim

   Medusa claims UMMC on its own leak site.

4. 20 March
   The deadline

   The date the group set for payment.

5. 23 April 2026
   The missing breach report

   Mississippi Today: UMMC does not appear to have filed one with HHS/OCR.

What we don't know — stated up front

Transparency comes before narrative here, because this case invites the temptation to fill in the blanks.

• The initial access vector at UMMC has not been made public by any source. How they got in is simply unknown.
• CISA advisory AA25-071A dates from March 2025, nearly a year before the attack, and does not mention UMMC. The chain below is the group's general profile, not a forensic report on UMMC. It's what Medusa usually does — not what has been established in Jackson, Mississippi.
• Attribution to Medusa rests solely on the group's own leak-site claim and press reporting. UMMC has never publicly confirmed the actor, nor whether it paid.
• The exfiltration figure — 1 TB, one million files — comes from the criminals themselves. It is unverified. The victim hasn't confirmed it, and the extortionist has an obvious interest in inflating it.
• Mississippi Today reported on 23 April 2026 that UMMC does not appear to have filed a breach report with HHS/OCR.

The attack chain

(Medusa's general profile per AA25-071A — ATT&CK v16. Not confirmed at UMMC.)

Entry comes via initial access brokers, phishing (T1566), or exploitation of known CVEs on exposed assets (T1190). Discovery follows with Advanced IP Scanner and SoftPerfect (T1046), plus PowerShell enumeration — systeminfo, net share, ipconfig /all (T1082, T1059.001).

Evasion is methodical: certutil to pull payloads, obfuscated PowerShell in base64/gzip, PowerShell history wiped, and signed drivers to kill EDR (T1562.001). C2 runs through Ligolo and Cloudflared. Credentials come from Mimikatz against LSASS (T1003.001).

Lateral movement is almost entirely living-off-the-land: PsExec via openrdp.bat (T1569.002), RDP (T1021.001), and legitimate RMM tooling — AnyDesk, Atera, ConnectWise, SimpleHelp, Splashtop. None of it is malware. All of it is probably already installed somewhere on your network.

Then Rclone for exfiltration (T1567.002), and finally the gaze.exe encryptor: AES-256, .medusa extension (T1486), shadow copies destroyed (T1490). Double extortion, contact within 48 hours over Tor or Tox, $10,000 to buy another day (T1657).

1. 01
   Initial access

   brokers, phishing or known CVEs on exposed assets
2. 02
   Discovery

   Advanced IP Scanner, SoftPerfect and PowerShell
3. 03
   Evasion

   signed drivers to kill EDR, obfuscated PowerShell
4. 04
   Lateral movement

   PsExec and RDP, plus legitimate RMM already on the network
5. 05
   Exfiltration and impact

   Rclone to the cloud, then gaze.exe and shadow copies destroyed

Detection

Hashes:

openrdp.bat   MD5  44370f5c977e415981febf7dbb87a85c
pu.exe        MD5  80d852cd199ac923205b61658a9ec5bc

Artefacts: ransom note !!!READ_ME_MEDUSA!!!.txt; .medusa extension; gaze.exe process.

Behaviours worth alerting on — these outlast hashes, which change:

vssadmin.exe Delete Shadows /all /quiet

A command that destroys shadow copies has no legitimate use in a healthcare environment. Also watch for: PowerShell carrying base64/gzip blobs, PowerShell history being cleared, known-vulnerable signed drivers loading, and RMM tools appearing on hosts that never had them.

Negotiation addresses: key.medusa.serviceteam@protonmail.com, MedusaSupport@cock.li.

Remediation

• Patch internet-facing assets. It's Medusa's preferred route when they aren't simply buying access.
• Segment the network. In healthcare that's the difference between losing a department and losing 35 sites.
• MFA on every remote service, RDP included.
• Offline, immutable, tested backups. Immutable, because Medusa deletes shadow copies. Tested, because a backup you've never restored is a hypothesis.
• Audit privileged accounts.
• A tested continuity plan for operating offline. This isn't the last item on the list. It's the first, and the next section explains why.

What it teaches

The most remarkable thing about UMMC isn't technical. It's organisational.

While IT was down, the oncology department built — in real time, mid-crisis — what Devika Das, director of hematology and oncology, described to The Record as:

"a fully functioning, offline, urgent infusion clinic"

That deserves a second read. Cancer patients on infusion therapy cannot wait for an Active Directory domain to be restored; chemotherapy runs on a clinical window. With no electronic health records, no order entry, no network, that unit rebuilt the clinical function on paper and human procedure. They didn't recover IT. They recovered care, which is not the same thing.

It demonstrates that operational resilience is not a by-product of cyber resilience. They are two distinct capabilities, and the second does not imply the first. Any continuity plan that opens with "we restore systems within X hours" is answering the wrong question. The right question is: what, concretely, do we keep doing if the systems don't come back today? UMMC had to answer by improvising. Organisations that already have the answer written down and rehearsed improvise a great deal less.

On the criminal side, Medusa's extortion structure is worth studying because it shows where the model is heading. Pay to have the data deleted. Pay to extend the deadline. Or a third party pays to buy it. This is no longer a two-party shakedown with a victim and an extortionist. It's an open auction, in which the victim is merely one potential buyer of their own data — and not necessarily the highest bidder.

And the structural fact stands: four Mississippi hospitals in three years. That isn't bad luck. It's a sector identified as vulnerable, in a region identified as vulnerable, hit repeatedly because it worked repeatedly.