Loading story…
North Korea-linked Lazarus Group (aka Diamond Sleet) has been reported using Medusa ransomware in at least one intrusion targeting an unnamed organization in the Middle East, with an additional, reportedly unsuccessful attempt against a U.S. healthcare organization. The activity was attributed by Broadcom’s Symantec/Carbon Black threat research, which noted Medusa is a ransomware-as-a-service (RaaS) operation launched in 2023 by a cybercrime group known as Spearwing; analysis of Medusa’s leak site also indicates numerous recent U.S. healthcare/non-profit victims, though it is unclear which were directly targeted by North Korean operators versus other Medusa affiliates. The reporting frames this as part of a broader trend of North Korean operators shifting from bespoke ransomware to leveraging “off-the-shelf” ransomware ecosystems.
Separately, Lazarus was also linked to a social-engineering operation targeting the CEO of security firm AllSecure via a fake LinkedIn recruiting workflow that led to a staged “technical interview.” The lure attempted to convince the target to download and open a code project in VS Code, which AllSecure’s analysis said contained multiple infection paths and delivered BeaverTail malware; the victim avoided compromise by refusing to run the files on their primary system and instead detonating them in an isolated environment. While both reports attribute activity to Lazarus, they describe distinct operations (ransomware deployment vs. recruiter/interview malware delivery) rather than a single unified incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting linked the social-engineering and malware activity to North Korea's Lazarus Group based on tooling, code patterns, and infrastructure associated with prior North Korean operations. This attribution was published as details of the attempted compromise became public.
After identifying that the malware was running in a professional data center environment rather than a home machine, the operators allegedly activated a kill switch to delete their progress. The campaign's apparent goal was theft of credentials and secrets including crypto wallets, browser passwords, SSH keys, and environment variables.
As part of the fake interview, the target was pressured to open a code folder in VS Code, but instead examined it in an isolated virtual machine. Analysis reportedly found three infection paths and BeaverTail malware that executed on folder open, fingerprinted the host, and beaconed to a command server every five seconds.
Chris Papathanasiou, CEO of AllSecure, was approached on LinkedIn by an attacker posing as a recruiter and drawn into a fake job interview process. During a video call, the supposed hiring manager briefly appeared using a face matching a real LinkedIn profile, suggesting possible identity theft or real-time deepfake use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **North Korean state-backed operators linked to Lazarus** (including a subgroup often tracked as **Andariel/Stonefly**) have been observed using **Medusa** ransomware in financially motivated extortion activity, including an attack on a target in the Middle East and an attempted/unsuccessful intrusion against a **U.S. healthcare** organization. The activity marks a shift from Lazarus’ previously observed ransomware usage (e.g., **Maui** and **Play**) toward leveraging a **ransomware-as-a-service (RaaS)** ecosystem; Medusa is assessed as a RaaS operated by the **Spearwing** cybercrime group, with hundreds of claimed victims and recent leak-site activity impacting U.S. healthcare and nonprofit organizations. Reporting highlighted tooling associated with the Lazarus-linked activity, mixing commodity and North Korea-linked components, including **Comebacker** (Diamond Sleet-linked), **Blindingcan** (RAT), credential theft/dumping utilities (e.g., **ChromeStealer**, **Mimikatz**), and network/proxy tooling (e.g., `curl`, **RP_Proxy**). Separate items in the set covered unrelated ransomware and threat activity: **Everest** ransomware’s claimed theft of patient data via a third-party supplier affecting Vikor Scientific/Vanta Diagnostics, a disruptive ransomware incident at the **University of Mississippi Medical Center**, and broader commentary on ransomware geopolitics and sector targeting; these do not provide additional corroboration on the Lazarus–Medusa linkage itself.
Jun 29, 2026
Breakglass Intelligence reported with high confidence that **Lazarus Group** operators deployed **Medusa ransomware** in a Hungarian intrusion, marking what it describes as the first concrete evidence of the DPRK-linked actor operating inside a ransomware-as-a-service affiliate ecosystem rather than using a bespoke encryptor. The case ties together a Lazarus-style loader, `TSMSISrv.dll`, and a Medusa ransomware payload, `gaze.exe`, submitted from the same incident. Researchers said the ransomware binary was built from a Medusa builder toolkit and contained an XOR-encoded configuration with **Tor-based negotiation infrastructure**, a victim ID, a **Tox** contact, an embedded RSA public key, and commands to disable security, backup, and recovery controls before encryption. The intrusion chain showed a long dwell period, with the loader compiled in March 2025 and the ransomware compiled in October 2025, suggesting roughly seven months of persistence before extortion. The loader reportedly abused **DLL sideloading** through the Windows `SessionEnv` service, used a Windows 8 IME SDK sample as camouflage, and incorporated **COM hijacking**, custom AES routines, and dual TLS callback anti-analysis techniques consistent with Lazarus tradecraft. Breakglass said the combination of Lazarus-style tooling and standard Medusa infrastructure indicates the group likely acted as a Medusa affiliate for monetization, attribution camouflage, and possible sanctions evasion, underscoring how nation-state operators are converging with criminal ransomware ecosystems.
Jun 29, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026