Loading story…
Symantec reported that North Korean state-backed operators linked to Lazarus (including a subgroup often tracked as Andariel/Stonefly) have been observed using Medusa ransomware in financially motivated extortion activity, including an attack on a target in the Middle East and an attempted/unsuccessful intrusion against a U.S. healthcare organization. The activity marks a shift from Lazarus’ previously observed ransomware usage (e.g., Maui and Play) toward leveraging a ransomware-as-a-service (RaaS) ecosystem; Medusa is assessed as a RaaS operated by the Spearwing cybercrime group, with hundreds of claimed victims and recent leak-site activity impacting U.S. healthcare and nonprofit organizations.
Reporting highlighted tooling associated with the Lazarus-linked activity, mixing commodity and North Korea-linked components, including Comebacker (Diamond Sleet-linked), Blindingcan (RAT), credential theft/dumping utilities (e.g., ChromeStealer, Mimikatz), and network/proxy tooling (e.g., curl, RP_Proxy). Separate items in the set covered unrelated ransomware and threat activity: Everest ransomware’s claimed theft of patient data via a third-party supplier affecting Vikor Scientific/Vanta Diagnostics, a disruptive ransomware incident at the University of Mississippi Medical Center, and broader commentary on ransomware geopolitics and sector targeting; these do not provide additional corroboration on the Lazarus–Medusa linkage itself.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Alongside its report, Symantec published indicators of compromise, malware hashes, network infrastructure details, and behavior-based detections related to the Lazarus-linked Medusa activity. The company also said its security products had been updated to detect and block the observed techniques.
On February 24, 2026, Symantec and the Carbon Black Threat Hunter Team published research assessing that North Korean Lazarus operators were using Medusa ransomware in financially motivated attacks. The report said this was the first time researchers had associated Lazarus with Medusa and noted attribution to a specific Lazarus subgroup remained uncertain.
The same reporting described an unsuccessful attempted intrusion against a U.S. healthcare organization in which Lazarus-linked actors tried to use Medusa ransomware for extortion. The case reinforced continued North Korean targeting of the U.S. healthcare sector.
Symantec and Carbon Black observed Lazarus-linked operators successfully deploy Medusa ransomware against an unnamed organization in the Middle East. The intrusion involved Lazarus-associated tooling such as Comebacker, Blindingcan, ChromeStealer, Mimikatz, Infohook, and RP_Proxy.
Since early November 2025, Medusa's leak site has listed at least four U.S. healthcare and nonprofit victims, including a mental health nonprofit and a school serving autistic children. Researchers cautioned that not all of these cases can be definitively attributed to Lazarus operators.
In July 2025, the U.S. Department of Justice unsealed charges against North Korean national Rim Jong Hyok for alleged involvement in ransomware attacks, including against U.S. healthcare entities. The action was accompanied by public allegations tying him to the Lazarus subgroup Stonefly/Andariel and a $10 million reward.
Palo Alto Networks Unit 42 reported in 2024 that a Lazarus subgroup associated with Andariel/Stonefly collaborated with the Play ransomware group. This was cited as prior evidence of North Korean actors working with established ransomware ecosystems.
Symantec said North Korean operators carried out financially motivated intrusions against three U.S. organizations in 2024, but ransomware was not deployed in those incidents. The activity was cited as part of Lazarus/Stonefly's broader shift toward revenue-generating operations.
Medusa began operating as a ransomware-as-a-service offering run by the Spearwing cybercrime group. Multiple sources describe it as emerging in 2023 and later being used by affiliates against hundreds of victims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcesecurityaffairs.com
Open sourcehackread.com
Open sourceinfosecurity-magazine.com
Open sourcego.theregister.com
Open sourcedarkreading.com
Open sourcesecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked **Lazarus Group** (aka **Diamond Sleet**) has been reported using **Medusa** ransomware in at least one intrusion targeting an unnamed organization in the Middle East, with an additional, reportedly unsuccessful attempt against a U.S. healthcare organization. The activity was attributed by Broadcom’s Symantec/Carbon Black threat research, which noted Medusa is a **ransomware-as-a-service (RaaS)** operation launched in 2023 by a cybercrime group known as **Spearwing**; analysis of Medusa’s leak site also indicates numerous recent U.S. healthcare/non-profit victims, though it is unclear which were directly targeted by North Korean operators versus other Medusa affiliates. The reporting frames this as part of a broader trend of North Korean operators shifting from bespoke ransomware to leveraging “off-the-shelf” ransomware ecosystems. Separately, Lazarus was also linked to a **social-engineering** operation targeting the CEO of security firm *AllSecure* via a **fake LinkedIn recruiting workflow** that led to a staged “technical interview.” The lure attempted to convince the target to download and open a code project in *VS Code*, which AllSecure’s analysis said contained multiple infection paths and delivered **BeaverTail** malware; the victim avoided compromise by refusing to run the files on their primary system and instead detonating them in an isolated environment. While both reports attribute activity to Lazarus, they describe **distinct operations** (ransomware deployment vs. recruiter/interview malware delivery) rather than a single unified incident.
Jun 29, 2026
Breakglass Intelligence reported with high confidence that **Lazarus Group** operators deployed **Medusa ransomware** in a Hungarian intrusion, marking what it describes as the first concrete evidence of the DPRK-linked actor operating inside a ransomware-as-a-service affiliate ecosystem rather than using a bespoke encryptor. The case ties together a Lazarus-style loader, `TSMSISrv.dll`, and a Medusa ransomware payload, `gaze.exe`, submitted from the same incident. Researchers said the ransomware binary was built from a Medusa builder toolkit and contained an XOR-encoded configuration with **Tor-based negotiation infrastructure**, a victim ID, a **Tox** contact, an embedded RSA public key, and commands to disable security, backup, and recovery controls before encryption. The intrusion chain showed a long dwell period, with the loader compiled in March 2025 and the ransomware compiled in October 2025, suggesting roughly seven months of persistence before extortion. The loader reportedly abused **DLL sideloading** through the Windows `SessionEnv` service, used a Windows 8 IME SDK sample as camouflage, and incorporated **COM hijacking**, custom AES routines, and dual TLS callback anti-analysis techniques consistent with Lazarus tradecraft. Breakglass said the combination of Lazarus-style tooling and standard Medusa infrastructure indicates the group likely acted as a Medusa affiliate for monetization, attribution camouflage, and possible sanctions evasion, underscoring how nation-state operators are converging with criminal ransomware ecosystems.
Jun 29, 2026
Multiple reports highlight evolving **ransomware** tactics and growing operational scale across distinct groups. Group-IB reported that **DeadLock** is using **Polygon smart contracts** to help obscure and rapidly rotate infrastructure used to connect victims to the gang, complicating defender blocking and analysis. After encryption, DeadLock reportedly drops an HTML file that wraps the *Session* messenger workflow; the smart contract stores a proxy URL that can be frequently changed, supporting an “encryption-only” model without a traditional public data leak site. Separately, Darktrace summarized late-2025/early-2026 intelligence indicating **Medusa** (aka **Storm-1175** / **Spearwing**) has become one of the most active RaaS operations, with reporting that **500+ organizations** have been impacted and that affiliates leverage vulnerabilities for access, including Fortra *GoAnywhere MFT* `CVE-2025-10035` and multiple *SimpleHelp* issues (`CVE-2024-57726`, `CVE-2024-57727`, `CVE-2024-57728`). Trellix research (via DataBreaches/Industrial Cyber) described **CrazyHunter** as a **Prince** ransomware fork written in Go, with enhanced intrusion and evasion techniques and a focus on **Taiwan healthcare**, citing **six confirmed victims** and use of a data leak site to pressure targets.
Jun 29, 2026