Loading story…
Breakglass Intelligence reported with high confidence that Lazarus Group operators deployed Medusa ransomware in a Hungarian intrusion, marking what it describes as the first concrete evidence of the DPRK-linked actor operating inside a ransomware-as-a-service affiliate ecosystem rather than using a bespoke encryptor. The case ties together a Lazarus-style loader, TSMSISrv.dll, and a Medusa ransomware payload, gaze.exe, submitted from the same incident. Researchers said the ransomware binary was built from a Medusa builder toolkit and contained an XOR-encoded configuration with Tor-based negotiation infrastructure, a victim ID, a Tox contact, an embedded RSA public key, and commands to disable security, backup, and recovery controls before encryption.
The intrusion chain showed a long dwell period, with the loader compiled in March 2025 and the ransomware compiled in October 2025, suggesting roughly seven months of persistence before extortion. The loader reportedly abused DLL sideloading through the Windows SessionEnv service, used a Windows 8 IME SDK sample as camouflage, and incorporated COM hijacking, custom AES routines, and dual TLS callback anti-analysis techniques consistent with Lazarus tradecraft. Breakglass said the combination of Lazarus-style tooling and standard Medusa infrastructure indicates the group likely acted as a Medusa affiliate for monetization, attribution camouflage, and possible sanctions evasion, underscoring how nation-state operators are converging with criminal ransomware ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On March 12, 2026, Breakglass Intelligence published analysis concluding with high confidence that Lazarus Group operators deployed Medusa ransomware as an affiliate in the Hungarian incident rather than using a bespoke ransomware family. The report described this as the first concrete evidence that Lazarus had entered the Medusa ransomware-as-a-service affiliate ecosystem.
A Medusa ransomware binary named gaze.exe was compiled in October 2025 and linked to the same Hungarian intrusion. Researchers assessed the roughly seven-month gap between the loader and ransomware builds as evidence of a long intrusion period before extortion.
A Lazarus-linked loader identified as TSMSISrv.dll was compiled in March 2025 and later tied to a Hungarian incident. Analysis says it used SessionEnv DLL sideloading, IME-themed camouflage, custom AES routines, COM hijacking, and dual TLS callback anti-analysis techniques to establish or maintain access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **North Korean state-backed operators linked to Lazarus** (including a subgroup often tracked as **Andariel/Stonefly**) have been observed using **Medusa** ransomware in financially motivated extortion activity, including an attack on a target in the Middle East and an attempted/unsuccessful intrusion against a **U.S. healthcare** organization. The activity marks a shift from Lazarus’ previously observed ransomware usage (e.g., **Maui** and **Play**) toward leveraging a **ransomware-as-a-service (RaaS)** ecosystem; Medusa is assessed as a RaaS operated by the **Spearwing** cybercrime group, with hundreds of claimed victims and recent leak-site activity impacting U.S. healthcare and nonprofit organizations. Reporting highlighted tooling associated with the Lazarus-linked activity, mixing commodity and North Korea-linked components, including **Comebacker** (Diamond Sleet-linked), **Blindingcan** (RAT), credential theft/dumping utilities (e.g., **ChromeStealer**, **Mimikatz**), and network/proxy tooling (e.g., `curl`, **RP_Proxy**). Separate items in the set covered unrelated ransomware and threat activity: **Everest** ransomware’s claimed theft of patient data via a third-party supplier affecting Vikor Scientific/Vanta Diagnostics, a disruptive ransomware incident at the **University of Mississippi Medical Center**, and broader commentary on ransomware geopolitics and sector targeting; these do not provide additional corroboration on the Lazarus–Medusa linkage itself.
Jun 29, 2026
North Korea-linked **Lazarus Group** (aka **Diamond Sleet**) has been reported using **Medusa** ransomware in at least one intrusion targeting an unnamed organization in the Middle East, with an additional, reportedly unsuccessful attempt against a U.S. healthcare organization. The activity was attributed by Broadcom’s Symantec/Carbon Black threat research, which noted Medusa is a **ransomware-as-a-service (RaaS)** operation launched in 2023 by a cybercrime group known as **Spearwing**; analysis of Medusa’s leak site also indicates numerous recent U.S. healthcare/non-profit victims, though it is unclear which were directly targeted by North Korean operators versus other Medusa affiliates. The reporting frames this as part of a broader trend of North Korean operators shifting from bespoke ransomware to leveraging “off-the-shelf” ransomware ecosystems. Separately, Lazarus was also linked to a **social-engineering** operation targeting the CEO of security firm *AllSecure* via a **fake LinkedIn recruiting workflow** that led to a staged “technical interview.” The lure attempted to convince the target to download and open a code project in *VS Code*, which AllSecure’s analysis said contained multiple infection paths and delivered **BeaverTail** malware; the victim avoided compromise by refusing to run the files on their primary system and instead detonating them in an isolated environment. While both reports attribute activity to Lazarus, they describe **distinct operations** (ransomware deployment vs. recruiter/interview malware delivery) rather than a single unified incident.
Jun 29, 2026
Multiple reports highlight evolving **ransomware** tactics and growing operational scale across distinct groups. Group-IB reported that **DeadLock** is using **Polygon smart contracts** to help obscure and rapidly rotate infrastructure used to connect victims to the gang, complicating defender blocking and analysis. After encryption, DeadLock reportedly drops an HTML file that wraps the *Session* messenger workflow; the smart contract stores a proxy URL that can be frequently changed, supporting an “encryption-only” model without a traditional public data leak site. Separately, Darktrace summarized late-2025/early-2026 intelligence indicating **Medusa** (aka **Storm-1175** / **Spearwing**) has become one of the most active RaaS operations, with reporting that **500+ organizations** have been impacted and that affiliates leverage vulnerabilities for access, including Fortra *GoAnywhere MFT* `CVE-2025-10035` and multiple *SimpleHelp* issues (`CVE-2024-57726`, `CVE-2024-57727`, `CVE-2024-57728`). Trellix research (via DataBreaches/Industrial Cyber) described **CrazyHunter** as a **Prince** ransomware fork written in Go, with enhanced intrusion and evasion techniques and a focus on **Taiwan healthcare**, citing **six confirmed victims** and use of a data leak site to pressure targets.
Jun 29, 2026