Medusa showed that a clinic’s remote-support software is its ransomware attack surface

The week

On March 12, 2025, CISA (the federal Cybersecurity and Infrastructure Security Agency), the FBI and the Multi-State Information Sharing and Analysis Center published joint advisory AA25-071A. The MS-ISAC shares threat information with state and local governments. The advisory’s subject was Medusa, a ransomware operation active since 2021. Ransomware is criminal software that scrambles an organization’s files so they cannot be used, followed by a demand for payment to unscramble them. These days it usually comes with a second threat: pay, or the stolen data gets published.

The advisory was part of the agencies’ #StopRansomware series, which profiles one criminal operation at a time and lists the observed techniques and the indicators defenders can search for. Each profile follows the same template. That consistency makes the series useful for comparison: when two profiles name the same tools and the same doors, the overlap is the signal.

Medusa had moved to what the advisory called an affiliate model. A core group maintains the malicious software and the extortion machinery, and independent “affiliates” carry out the break-ins in exchange for a cut. The agencies said Medusa had affected more than 300 victims in critical infrastructure sectors as of February 2025, including medical, education, legal, insurance, technology and manufacturing organizations.

The advisory also described how Medusa bought its way in. Its developers recruited initial access brokers, criminals who break into networks and sell that access to others, through cybercrime forums. The advertised payments ranged from $100 to $1 million, with the option to work exclusively for Medusa. A market like that means a forgotten, exposed door does not stay forgotten for long. Someone is paid to find it.

They got in through two familiar doors. One was phishing, the deceptive emails that trick staff into handing over passwords or opening something harmful. The other was unpatched internet-facing software: programs reachable from the open internet that had known security flaws their owners had not yet fixed. The advisory named flaws in ConnectWise ScreenConnect, a remote-support product, and in Fortinet’s endpoint management server, which manages the security software installed on an organization’s computers.

Neither flaw was new. The ScreenConnect authentication bypass, CVE-2024-1709, had been added to CISA’s catalog of known exploited vulnerabilities in February 2024. The Fortinet flaw, CVE-2023-48788, joined that catalog in March 2024. By the time of the advisory, fixes for both had been public for about a year.

Once inside, affiliates used remote access products such as AnyDesk, Atera, ConnectWise, N-able, Splashtop and SimpleHelp. These are the legitimate tools IT teams use to take control of a computer from somewhere else. They mapped networks with ordinary scanning utilities such as Advanced IP Scanner and SoftPerfect Network Scanner, and moved between machines with Remote Desktop and PsExec. The attackers tried to disable endpoint detection, the security software that watches each computer for suspicious behavior, by loading vulnerable drivers, which are low-level pieces of software with deep access to the machine. They exfiltrated (copied out) data with Rclone, a free tool for moving files to cloud storage.

The extortion stage was described in unusual detail. The ransom note demanded contact within 48 hours through a browser-based chat on the Tor anonymity network or through Tox, an encrypted messenger. Victims who stayed silent could expect a phone call or an email. Victims then faced a leak site with a countdown timer, a public web page threatening to release their data when the clock ran out. Paying $10,000 in cryptocurrency bought one more day on the clock.

The FBI also recounted a case in which a victim paid, and a different Medusa actor then claimed the first negotiator had stolen the payment. That actor demanded half the ransom again for the “true decryptor.” The FBI said this could be a third round of extortion or a sign of disorder inside the group. Either way, paying did not end the matter.

The mitigations list was conventional: phishing-resistant multifactor authentication, prompt patching of internet-facing systems, network segmentation, audits of administrative accounts, disabling unused ports, and offline, tested backups. The agencies also noted that Medusa was unrelated to MedusaLocker or the Medusa mobile malware, which only share the name.

For healthcare, the timing mattered. Five days earlier, on March 7, the comment period had closed on the federal health department’s proposed overhaul of the HIPAA Security Rule. That proposal would make asset inventories and multifactor authentication explicit requirements. The advisory read like a field report on why those requirements had been proposed.

Read closely, the Medusa advisory is less a description of a criminal gang than an inventory of the software hospitals and clinics use to look after themselves. Remote-support agents, endpoint management servers and software deployment tools appear on almost every page. Each was built for a good reason: to give a trusted person control of a machine from somewhere else. Medusa’s affiliates simply stepped into that trusted person’s shoes.

For a health system or a network of outpatient clinics, that changes the shape of the defensive problem. Recognizing particular pieces of malware matters less than how the organization governs its own administrative tooling. In an attack like this one, that tooling plays three distinct roles, and each needs a different control. It is the way in, the way around, and the cover for switching off defenses.

The pattern was not new in March 2025. In January 2023, CISA, the National Security Agency and the MS-ISAC had warned about criminals using legitimate remote monitoring software as a backdoor. In February 2024, attackers entered Change Healthcare through a remote-access portal that lacked multifactor authentication, according to UnitedHealth’s chief executive in congressional testimony that May. What Medusa added was a single document that named the whole toolkit, stage by stage.

Three families of administrative tools

Most executives never see the software that keeps their organization’s computers running. Three families of it matter here.

Remote-support and remote-access tools. Products such as ScreenConnect, AnyDesk and Splashtop let a technician see your screen and move your mouse from another building or another state. When a nurse calls the help desk because a printer will not connect, this is how the technician fixes it without walking over.

Remote monitoring and management tools. Often shortened to RMM, products such as Atera, N-able and SimpleHelp go further. They let an IT team, or an outside managed service provider, watch the health of hundreds of computers at once, install updates and run commands on all of them. If a remote-support tool is a single key, an RMM tool is the building’s master key ring.

Endpoint management and deployment tools. An “endpoint” is any device at the edge of the network: a laptop, a workstation at a nursing station, a server in a closet. Endpoint management servers, such as Fortinet’s FortiClient EMS named in the advisory, control the security software on those devices. Deployment tools such as PDQ Deploy and BigFix, and standard administrative utilities such as PsExec, push files and instructions out to many machines at the same time.

All three share one property. They are designed to give someone who is not sitting at a computer full, trusted control of it. That is precisely what an attacker wants. A security team trying to spot an intruder is looking for unusual behavior, and these tools make intrusion look like routine maintenance.

How the connection actually works

Most modern remote-support products do not wait for an inbound connection through the firewall. The agent on the managed computer reaches out to the vendor’s cloud relay over ordinary encrypted web traffic. The technician connects to the same relay, and the relay joins the two sessions.

That design is convenient, and it explains why these tools are so hard to police. A firewall that blocks inbound traffic sees nothing unusual. The outbound connection looks like any other web session to a cloud service. Unless the organization deliberately blocks the relay domains of products it has not approved, any agent installed by anyone will connect.

The January 2023 advisory added a second complication. Several of these products ship as portable executables, single files that run without installation or administrator rights. A user who is tricked into downloading one can hand over control of their computer without any software ever appearing in the installed-programs list. Controls built around what is installed will miss what is merely run.

Who owns them in a health system

In a bank or a federal agency, administrative tools usually belong to one IT organization. In a health system, they are spread across several owners who rarely meet.

• Desktop and service desk teams run the remote-support product used for staff computers.
• Clinical engineering, sometimes called biomedical engineering, manages medical devices and the vendor connections that come with them.
• The electronic health record team works with the record vendor and its consultants, who often need administrative access to interface servers.
• Acquired practices bring their own managed service providers, each with its own RMM console.
• Departmental systems, such as pharmacy automation, radiology reading tools and laboratory middleware, come with their own support arrangements.

Each owner chose a tool that made sense locally. Nobody chose the total. That is why the first question in any program to govern these tools is simply how many there are and who answers for each one.

Entry: management products as the front door

Both vulnerabilities named in the advisory affect management software. ScreenConnect is a remote-support product. FortiClient EMS manages endpoint security agents. When either faces the internet unpatched, an attacker inherits a channel designed to reach every machine it manages. That is a far better starting position than a single phished laptop.

A word on “unpatched.” Software makers regularly discover flaws in their products and release fixes, called patches. Between the day a fix is published and the day an organization installs it, the flaw is publicly known and the door is still open. Criminals study published fixes precisely because they reveal where the doors are. Internet-facing management software is the most valuable door of all, because it is reachable from anywhere and controls so much.

Why year-old flaws still worked

The two flaws named were roughly a year old when the advisory appeared. Their continued use says more about how management servers are patched than about the attackers’ skill.

Management servers are often installed once, by a project team or a contractor, and then left alone because they work. They may run on an older server in a data center that nobody wants to reboot during clinic hours. ConnectWise patched the cloud-hosted version of ScreenConnect itself in February 2024. Customers who ran the product on their own servers had to install the fix themselves. Many health organizations, especially those supported by outside contractors, did not know which version they ran.

Patching the server is also only half of the job. If an attacker used the flaw before the fix went in, they may already have created accounts or planted their own agents. CISA’s guidance on several such flaws has told organizations to hunt for signs of compromise as well as patch. A patch closes the door but does not remove anyone who came through it.

Why healthcare has more doors

Healthcare carries more of these exposures than most sectors, and for structural reasons. Imaging machines, laboratory analyzers and pharmacy systems often ship with the vendor’s own remote-support access built in, so the manufacturer can diagnose problems. Physician groups acquired by a health system arrive with their own managed service provider and its tools. Consultants who help install an electronic health record system are given access during the go-live and sometimes never lose it. The security team designed none of these paths, and many are invisible to it.

Medical devices add a regulatory wrinkle. Manufacturers often validate a device’s software configuration with the Food and Drug Administration in mind, and hospitals are reluctant to change it. Since 2023, federal law has required manufacturers of new networked devices to include cybersecurity information in their premarket submissions, including plans to address vulnerabilities. That helps for new devices. It does little for the analyzer bought in 2016, whose vendor still expects to dial in its own way.

Suppose a regional health system runs three hospitals and forty clinics. Over a decade it has acquired six physician practices, each with its own IT contractor. Its CT scanners phone home to the manufacturer. Its laboratory vendor has a support agent on the analyzer workstations. If you asked its leadership how many outside parties can take control of a computer on their network, the honest answer would be “we are not sure.” That uncertainty is the attack surface.

One brokered route for outsiders

The control is a single brokered route for third-party access. Vendors connect through a privileged access gateway that the health system owns. Every vendor technician signs in under a named account. Each gets a time-limited session that works only for the systems and hours they need. They prove who they are with multifactor authentication, such as a code on a phone, and the session is recorded. The advisory itself recommends requiring VPNs (encrypted private connections) or jump hosts (a single hardened computer that all remote sessions must pass through) for remote access. It also recommends filtering traffic so untrusted sources cannot reach internal remote services.

A sensible sequence starts with the outside view. Scan the organization’s own internet-facing address ranges, or use a commercial attack-surface service, to list every management console visible from the internet. Compare that list with CISA’s known exploited vulnerabilities catalog, which names flaws attackers are already using. Federal civilian agencies must fix catalog entries by set deadlines under a 2021 CISA directive. Health systems are not bound by it, but the same discipline works for them.

Next, take management consoles off the open internet where possible, and put the rest behind the gateway or a VPN with phishing-resistant multifactor authentication. Then move vendors onto the gateway one at a time, starting with those who reach clinical systems. Each migration needs a test window, a rollback plan and a clinical engineering sign-off.

Contracts, and the clinical emergency objection

The harder work is contractual. Device and software agreements should require vendors to use the organization’s gateway and forbid them from installing their own persistent agents. Clinical engineering, procurement and the chief information security officer need to agree on that language before the next contract renewal, not after an incident. A vendor that has signed a contract permitting its own always-on access will not give it up because the security team asks politely.

The strongest objection comes from clinicians. If an infusion pump server or an imaging system fails at two in the morning, nobody wants the vendor’s engineer waiting for an access approval. The answer is a pre-approved emergency path: standing approval for named vendor staff on named systems, with automatic session recording and a review the next business day. Speed and accountability are compatible if the emergency path is designed in advance.

The arrangement looks different by type of organization. A large academic medical center may run its own gateway and a security operations center that watches sessions live. An ambulatory network of twenty clinics usually depends on a managed service provider. Its main lever is the MSP contract: multifactor authentication on the MSP’s consoles, logging the clinic can see, and prompt notice of any compromise. A small physician practice may have neither, and should at least know which tools its contractor uses and insist they are patched.

Movement: legitimate tools as the attacker’s workforce

Getting in is only the beginning. To do serious damage, an intruder has to spread from the first machine to the servers and systems that matter. Security professionals call this lateral movement, and it is where Medusa’s reliance on legitimate tools paid off.

Once inside, Medusa affiliates installed or reused remote management products to move between machines and stage their payload, the encrypting software they would eventually unleash. Endpoint security tools rarely flag this activity. The programs are digitally signed, meaning their maker has vouched for them; the vendors are reputable; and the same tools are legitimately present on other computers in the building. A clinic with five remote-support products in daily use offers an intruder five forms of camouflage.

The sequence inside the network

The advisory’s description follows a familiar order. Affiliates first mapped the network with scanning utilities that IT staff also use. They used PowerShell and the Windows command prompt, both built into every Windows computer, to look around and to download more tools. They opened Remote Desktop where it was closed and used it to log in to machines interactively.

They then went after credentials. The advisory describes affiliates copying the Active Directory database, the central store of user accounts and password hashes, by way of a shadow copy, a point-in-time snapshot Windows keeps for recovery. With those credentials an intruder can sign in as an administrator, and every later step looks like an administrator at work.

Software deployment tools add a further layer. The advisory notes affiliates using products such as PDQ Deploy and BigFix, and standard utilities such as PsExec, to push files and commands across many hosts at once. In a hospital, the same deployment console that pushes an electronic health record update to every workstation overnight can push an encryptor just as efficiently. The efficiency that IT built for itself becomes the attacker’s efficiency.

Fewer tools, enforced

The defensive measure is to shrink the number of these tools deliberately. Pick one or two approved remote management products for the whole enterprise and block the rest. Application control can prevent unapproved remote tools from running at all: if a program is not on the approved list, it does not run. On Windows, application control is implemented through Windows Defender Application Control or AppLocker policies. Egress filtering, which controls what traffic is allowed to leave the network, can block connections to the cloud relay services those products use, except for the approved ones.

Application control is easier to describe than to deploy in a hospital. Clinical departments run hundreds of small applications, some from vendors that no longer exist. A full allowlist for every workstation can take years. A narrower rule works sooner: block the known category of remote-access and RMM products, by publisher, except the approved ones. Run it first in audit mode, which logs what would have been blocked without blocking it. Use those logs to find the departments and vendors that need a conversation.

Inventory comes before enforcement. Endpoint detection software, software inventory tools and network logs can each show which remote-access products are present or calling out. Combining the three usually turns up products nobody listed, including portable copies run once and forgotten.

Detection can cover what blocking cannot yet reach. An alert on any new remote-access product installed on a server catches one step of the pattern. So does an alert when an approved RMM agent starts PowerShell on many machines within minutes. Both are simple to write in most endpoint detection products, and both can be tuned against the change calendar so planned maintenance does not trigger them.

Making stolen credentials less useful

Consolidation narrows the toolkit. Account hygiene makes each tool less powerful in the wrong hands. The advisory recommends auditing administrative accounts and applying least privilege, meaning each account gets only the access its job requires.

Concretely, that means separate accounts for administrative work, so a technician’s everyday email account cannot also run commands on every server. It means unique local administrator passwords on each machine, which Microsoft’s Local Administrator Password Solution manages automatically. And it means restricting which machines may run deployment consoles and PsExec-style tools at all. If only three hardened servers can push software, an intruder on a nursing workstation cannot.

Segmentation completes the picture. Clinical device networks, administrative networks and guest networks should be separated, with rules about which traffic may cross. Remote Desktop from ordinary workstations to servers is a common path worth closing. The aim is to make each step of lateral movement either blocked or noisy.

A number the board can follow

A useful metric for the board is the count of distinct remote access products seen on endpoints each month, with a target the chief information security officer commits to. A non-technical director can understand and track that number. If it goes from eleven to three over a year, the organization has genuinely reduced its exposure. If it stays at eleven, the board knows to ask why.

The trade-off is real. Device vendors write support terms around their preferred tool, and some will resist. Departments that rely on a particular product will push back when it disappears. Expect a period of exceptions, each with an owner and an expiry date. Without expiry dates, exceptions harden into the old sprawl. A good rule of thumb is that every exception should have a person’s name on it and a date when it will be reviewed or removed.

The concentration objection

A serious counter-argument deserves an answer. Consolidating on one RMM product concentrates risk. If that one product has a flaw, or its console is compromised, an attacker reaches everything at once. The July 2021 attack on Kaseya’s VSA software showed the danger: criminals used it to push ransomware through managed service providers to many of their customers. SimpleHelp, discussed below, did the same in 2025.

The argument is correct about the risk and wrong about the alternative. Eleven unmanaged tools carry the same concentration risk eleven times over, each with patching nobody tracks. One approved tool can be patched on a known schedule, kept off the open internet, protected with phishing-resistant multifactor authentication and watched closely. Consolidation works only if the surviving tool is treated as the most sensitive system the organization runs.

Evasion: trusted access as cover for switching off defenses

The third role is the one most healthcare environments leave open. Before setting off the encryption, an intruder wants to blind the security team.

The March 2025 advisory described affiliates trying to kill endpoint detection with vulnerable or signed drivers, and disabling Windows Defender and other antivirus services on targeted hosts before pushing the encryptor. A driver is a small, highly privileged piece of software that lets the operating system talk to hardware. Because drivers run with deep access, a flawed one can be abused to shut down security software that would otherwise resist being switched off. Attackers bring along an old driver with a known flaw, load it, and use it to force the security software off.

The technique is often called “bring your own vulnerable driver.” It works because Windows will load a driver that carries a valid signature, even an old one with a published flaw. The driver is legitimate. Its misuse is the attack.

The encryptor itself, which the advisory calls gaze.exe, continues the same pattern. It stops services tied to backups, security tools and databases, deletes the shadow copies Windows keeps for recovery, then encrypts files and leaves a ransom note. Each step removes something that would help the organization recover without paying.

Later detail on the same theme

An August 2026 update to the advisory added more detail. It described disabling Defender through Group Policy, a built-in Windows settings tool. It also described placing tools such as Rclone in folders already excluded from antivirus scanning. Each technique turns administrative access into the means of blinding the security team.

Antivirus exclusions deserve particular attention in hospitals. An exclusion is an instruction telling the security software to ignore a particular folder or program. Electronic health record, imaging and laboratory vendors often request broad exclusions because scanning can slow their systems down, and those exclusions accumulate over years without review. An attacker who finds an excluded directory has a safe place to work. A quarterly review of exclusions, with each one tied to a documented vendor requirement, removes much of that cover.

The review is tedious but not difficult. Export the exclusion list from the endpoint management console. Match each entry to a vendor document or a ticket. Narrow broad entries, such as an entire drive, to the specific files the vendor named. Remove anything nobody can explain, and watch the help desk queue for a week.

Controls that make the defenses resist

Three further controls address the rest. Turn on Microsoft’s vulnerable driver blocklist, which stops known-bad drivers from loading. Turn on tamper protection in the endpoint detection and response (EDR) software across the estate, so the security agent resists being switched off. Treat a sensor that stops reporting as a security incident, not a help desk ticket, because a silent agent is often the first sign of evasion. And watch for large outbound transfers to cloud storage, since Rclone exfiltration precedes the leak-site threat.

Microsoft enables the driver blocklist by default on current versions of Windows 11. Hospitals tend to run older builds on clinical workstations and devices, where it may be off. Windows 10 reached the end of support in October 2025, which turned this into a migration question as well as a setting.

Tamper protection has its own trade-off. It stops an attacker with administrator rights from disabling the agent. It also stops a well-meaning technician from doing so to troubleshoot a slow clinical application. The organization needs a documented, logged way to suspend protection on one machine for a short time, approved by the security team.

The silent-agent alert needs an owner and a clock. If the security operations center sees a server stop reporting at 1 a.m., someone should check it within the hour. For a community hospital without a 24-hour security team, this is a reason to buy managed detection and response from an outside provider. It is also a reason to read that provider’s contract for how quickly it will act on a host as well as how quickly it will alert.

Backups, exfiltration and the HIPAA analysis

Backups are the attacker’s next target. The advisory recommends offline backups, kept encrypted, immutable (unchangeable once written) and regularly tested. Immutability matters because an intruder with administrative credentials can often reach the backup console too. A backup that the same administrator account can delete is not a dependable recovery point.

Watching outbound transfers has a compliance dimension that matters directly to general counsel. If patient data leaves the network, a covered entity or business associate under HIPAA, the federal health privacy law, faces a breach analysis even when backups restore every system. Restoring from backup fixes the outage but does not undo the theft.

The federal health department’s 2016 guidance on ransomware goes further. It says that when ransomware encrypts electronic protected health information, a breach is presumed. The presumption stands unless the organization can show a low probability that the information was compromised, through a documented risk assessment. Breaches affecting 500 or more people must also be reported to the department and, in most cases, to local media.

Organizations should work through notification decisions with counsel, but they need the telemetry, the logs showing what left and when, before they can make those decisions at all. Without network logs and endpoint records, the risk assessment has nothing to stand on, and the presumption tends to win.

Patient care, money and the decisions only executives can make

This belongs with leadership as well as the IT department, for four reasons.

Patient care. When a hospital’s systems are encrypted, clinicians fall back to paper, ambulances may be diverted and scheduled procedures can be postponed. The technology failure becomes a clinical and community event within hours.

Downtime procedures decide how bad those hours are. Printed medication lists, paper order sets and practiced manual workflows let clinicians keep working safely. Many hospitals drill for a single system outage. Fewer drill for losing every system at once for weeks, which is what a full encryption event looks like.

Money. Recovery costs, lost revenue from cancelled services, outside forensic and legal help, and the ransom question itself all land on the income statement. Many of these costs are larger than the security investment that might have prevented them.

The Change Healthcare attack showed how far the costs travel. Because that company processed claims for much of the country, its outage disrupted payments to providers that had never been attacked themselves. UnitedHealth later put the number of affected people at about 190 million. A clinic network’s exposure includes its clearinghouse, its billing vendor and its managed service provider.

Regulators and lawyers. A data theft involving patient records triggers HIPAA breach analysis and, depending on the facts, notification to patients and regulators. The quality of the organization’s records about who had access, and what left the network, shapes how that conversation goes.

Cyber insurance adds another reader. Underwriters routinely ask whether remote access requires multifactor authentication and how many remote tools are in use. An answer that turns out to be wrong after an incident can complicate a claim. The questionnaire deserves the same care as a regulatory filing.

Reputation and relationships. Patients, referring physicians and partners judge a health system by how it handles a crisis. Being able to say clearly how outsiders reach your systems, and how that access is controlled, is part of earning their trust.

Who decides, and with what authority

Above all, the decisions that close these gaps concern contracts with vendors and the authority of the security team to say no. They also concern the tolerance of clinical departments for change, and the willingness of leadership to fund and enforce consolidation. Those are executive decisions.

Ownership is usually split. The chief information officer runs the tools. The chief information security officer sets the rules. Clinical engineering manages device vendors. Supply chain signs the contracts. A program to govern remote access needs one executive sponsor who can settle disputes among them, and a standing agenda item where exceptions are reviewed.

Funding follows a similar pattern. A privileged access gateway, application control rollout and managed detection service each cost money and staff time. The voluntary cybersecurity performance goals the federal health department published in January 2024 include multifactor authentication and vendor security among their essential goals. Boards can use those goals as a yardstick for whether the budget matches the exposure.

Signs the doors are under control

An organization that has taken the Medusa pattern seriously tends to show a handful of visible traits.

• It can produce, within a day, a list of every outside party that can remotely control a computer on its network, and the route each one uses.
• Every one of those routes passes through a gateway the organization owns, with named accounts and recorded sessions.
• Its internet-facing management consoles are known, patched against every entry in the known exploited vulnerabilities catalog, and mostly hidden behind the gateway.
• It has one or two approved remote management products, and application control blocks the others.
• Administrative accounts are separate from everyday accounts, and only a few hardened machines can push software across the network.
• Antivirus exclusions are reviewed on a schedule, and each has a documented reason.
• A security agent that goes silent sets off an alarm, not a ticket in a queue.
• At least one backup copy cannot be altered or deleted by the same accounts that run production.
• Vendor contracts state clearly how remote access works and who controls it.

The failures are just as recognizable.

• Treating it as a patching problem only. Patching internet-facing software quickly is essential, but it does not address the sprawl of legitimate tools that let an attacker move and hide once inside.
• Patching without hunting. A fix installed after exploitation leaves the intruder’s accounts and agents in place.
• Buying another tool. Adding a new security product without removing old remote-access products can increase the number of doors rather than reduce it.
• Exceptions without end dates. Every consolidation program creates exceptions. The ones without owners and expiry dates become permanent by default.
• Forgetting acquired practices. Newly acquired physician groups and their managed service providers are often the least visible and least governed part of the estate.
• Consolidating without hardening. One approved RMM product left exposed to the internet is a single door to everything.
• Assuming backups solve everything. Backups restore operations. They do nothing about data that has already been copied out and is sitting behind a countdown timer.

Across all three roles, the common thread is ownership. Someone has to be accountable for every route by which a remote party can control a clinical or business system. That person needs the authority to say no to a vendor, and the backing of leadership when they do.

Who holds the keys, and who can refuse a vendor

These questions need no technical knowledge, and the answers reveal a great deal.

1. How many different remote access and remote management products are running on our computers today, and what is our target number?
2. Can every outside vendor who supports our devices reach them only through a gateway we own, with their own named account and a recorded session?
3. Do our device and software contracts say who controls remote access, and do any of them permit a vendor’s own always-on connection?
4. If a security agent on a server stopped reporting tonight, who would know, and how quickly?
5. Who is the single person accountable for remote access across the whole organization, including recently acquired practices, and do they have the authority to refuse a vendor?

With hindsight

The pattern the advisory described held through 2025 and into 2026. In June 2025, CISA warned that ransomware actors had exploited unpatched SimpleHelp remote management software to reach customers of a utility billing software provider. It was a direct case of a management tool serving as a supply chain door: compromise the software one provider uses to look after its clients, and you can reach the clients too. The same logic applies to every managed service provider that supports a physician practice or clinic.

The SimpleHelp details matched the Medusa story closely. The flaw, CVE-2024-57727, affected SimpleHelp version 5.5.7 and earlier. CISA said exploitation had been under way since January 2025, and it had added the flaw to its known exploited catalog in February. It told software vendors to check their server version, isolate unpatched servers and warn downstream customers. It told customers to look for SimpleHelp embedded inside other software they had bought. SimpleHelp was also one of the products named in the Medusa advisory. Consolidating on a single RMM product helps only if that product is patched and kept off the open internet.

In October 2025, Microsoft reported that a group it tracks as Storm-1175, known for deploying Medusa, had exploited a flaw in Fortra’s GoAnywhere file transfer software. Microsoft saw related activity on September 11, a week before Fortra published its advisory on September 18. The intruders used SimpleHelp and MeshAgent, another remote management agent, to keep their foothold, and deployed Medusa in at least one environment. The window between disclosure and exploitation had closed to nothing.

In February 2026, CISA added a command injection flaw in BeyondTrust Remote Support and Privileged Remote Access to the same catalog, marking it as used in ransomware campaigns. BeyondTrust sells exactly the kind of brokered vendor-access product this article recommends. The irony is real, and it points to the same conclusion. The gateway itself has to be patched as fast as anything the organization runs.

In August 2026, CISA updated the Medusa advisory itself, with HHS, the federal health department, joining as a co-author. HHS’s presence on the byline is a signal in itself about how squarely this threat sits in healthcare. The update put victims at more than 500 as of April 2026, up from more than 300 in the original advisory. It added newer exploited flaws in file transfer and remote-support products, including Fortra GoAnywhere and BeyondTrust. It said Medusa actors had been seen exploiting new vulnerabilities within 24 hours of their announcement. It also listed additional remote agents, including MeshAgent. The categories of software under attack did not change. Only the brand names on the list grew longer.

On the regulatory side, HHS’s January 2025 proposal to overhaul the HIPAA Security Rule, which would make asset inventories, multifactor authentication and segmentation explicit expectations, remained a proposal into late 2026. Segmentation means dividing a network into compartments so that a break-in in one area cannot easily spread to the rest. The federal regulatory agenda pushed final action out to 2027.

Health systems that waited for the rule to force remote-access governance are still waiting. Those that consolidated their remote tools in 2025 did the work on their own timetable, and on their own terms with vendors rather than under the pressure of an incident.

Some of the original argument needs a sharper edge in hindsight. The recommendation to consolidate on one or two products held up. What 2025 and 2026 added is that the surviving products, and the gateway in front of them, became prime targets. Patching speed measured in weeks was no longer enough for internet-facing management software. Organizations that pulled those consoles off the internet entirely were better placed than those that only patched faster.

Nothing in this story depended on exotic technology. The attackers used the same tools a hospital’s own help desk uses. That makes the defense less about buying something new and more about deciding, and enforcing, who is allowed to hold the keys.