Loading story…
U.S. authorities said North Korean state-backed cyber actors used Maui ransomware to target organizations in the Healthcare and Public Health Sector, including hospitals and health centers. A joint advisory from CISA, the FBI, and the Treasury Department linked the activity to North Korean operators and said the attacks disrupted medical services by encrypting servers and critical systems. Reporting on the campaign said victims included healthcare entities in states such as Kansas and Colorado, underscoring a focused effort against providers whose operations are highly sensitive to downtime.
The Justice Department later announced it had seized about $500,000 in cryptocurrency tied to Maui ransomware payments made after 2021 intrusions at healthcare organizations. Officials said the recovery was part of a broader effort to trace and claw back ransom proceeds connected to North Korean cyber operations, while federal agencies urged healthcare defenders to harden remote access, patch exposed systems, segment networks, and maintain offline backups to reduce the impact of ransomware attacks.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced the seizure of roughly $500,000 in cryptocurrency traced to ransom payments made by healthcare providers affected by Maui ransomware in 2021. The action was part of efforts to recover funds linked to North Korean cyber activity.
CISA released alert AA22-187A detailing Maui ransomware activity, associated tactics, techniques, and procedures, and mitigation guidance for defenders. The alert formalized public technical reporting on the campaign.
U.S. authorities disclosed that North Korean state-sponsored cyber actors were using Maui ransomware to target the healthcare and public health sector. The advisory described Maui as being used since at least May 2021 against healthcare entities.
In 2021, Maui ransomware was used in attacks against healthcare organizations including facilities in Kansas and Colorado. The incidents disrupted healthcare services and led the victims to make ransom payments.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
techtarget.com
Open sourcetherecord.media
Open sourcecisa.gov
Open sourcetechtarget.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. federal agencies warned that hospitals and healthcare providers faced an **imminent and credible** ransomware threat as multiple organizations were already dealing with disruptive intrusions linked to the **Ryuk** ecosystem. The joint alert from **CISA**, the **FBI**, and **HHS** said the healthcare and public health sector was being actively targeted, while reporting indicated threat actors had discussed deploying ransomware across hundreds of U.S. healthcare facilities. Several hospitals reported operational impacts consistent with the campaign, including **St. Lawrence Health System** in New York and **Sky Lakes Medical Center** in Oregon, while the **University of Vermont Health Network** disclosed a major network outage under investigation as a possible cyberattack. Security researchers and incident responders tied the activity to Ryuk and associated operators, describing it as a significant escalation that disrupted hospital systems, forced some patient diversions, and raised concern that additional healthcare organizations could be hit.
Aug 15, 2026
U.S. and private-sector reporting tied North Korea-linked operators to intrusions and ransomware activity affecting healthcare, medical research, and energy-related organizations, with proceeds assessed to support DPRK cyber operations. CISA warned that ransomware attacks on critical infrastructure, particularly healthcare and public health entities, were being used to generate revenue for North Korean malicious cyber activity, while WithSecure detailed a Lazarus campaign that compromised medical research and energy supply-chain targets through unpatched Zimbra servers using `CVE-2022-27925` and `CVE-2022-37042`, then escalated privileges with `CVE-2021-4034` and moved into Windows environments for credential theft, persistence, and data theft.
Aug 21, 2026
Symantec reported that **North Korean state-backed operators linked to Lazarus** (including a subgroup often tracked as **Andariel/Stonefly**) have been observed using **Medusa** ransomware in financially motivated extortion activity, including an attack on a target in the Middle East and an attempted/unsuccessful intrusion against a **U.S. healthcare** organization. The activity marks a shift from Lazarus’ previously observed ransomware usage (e.g., **Maui** and **Play**) toward leveraging a **ransomware-as-a-service (RaaS)** ecosystem; Medusa is assessed as a RaaS operated by the **Spearwing** cybercrime group, with hundreds of claimed victims and recent leak-site activity impacting U.S. healthcare and nonprofit organizations. Reporting highlighted tooling associated with the Lazarus-linked activity, mixing commodity and North Korea-linked components, including **Comebacker** (Diamond Sleet-linked), **Blindingcan** (RAT), credential theft/dumping utilities (e.g., **ChromeStealer**, **Mimikatz**), and network/proxy tooling (e.g., `curl`, **RP_Proxy**). Separate items in the set covered unrelated ransomware and threat activity: **Everest** ransomware’s claimed theft of patient data via a third-party supplier affecting Vikor Scientific/Vanta Diagnostics, a disruptive ransomware incident at the **University of Mississippi Medical Center**, and broader commentary on ransomware geopolitics and sector targeting; these do not provide additional corroboration on the Lazarus–Medusa linkage itself.
Jun 29, 2026