Loading story…
U.S. and private-sector reporting tied North Korea-linked operators to intrusions and ransomware activity affecting healthcare, medical research, and energy-related organizations, with proceeds assessed to support DPRK cyber operations. CISA warned that ransomware attacks on critical infrastructure, particularly healthcare and public health entities, were being used to generate revenue for North Korean malicious cyber activity, while WithSecure detailed a Lazarus campaign that compromised medical research and energy supply-chain targets through unpatched Zimbra servers using CVE-2022-27925 and CVE-2022-37042, then escalated privileges with CVE-2021-4034 and moved into Windows environments for credential theft, persistence, and data theft.
TTPs, infrastructure, and targeting history in one profile.
16 events from the most recent confirmed update back to the earliest known activity.
A Lazarus-linked IP address, 23.237.32[.]34, exchanged data 1,158 times with an IP attributed to a U.S. state government on a single day. SecurityScorecard identified the government IP's hostname as a subdomain associated with the state's oil and gas board web applications.
CISA and U.S. and South Korean partner agencies published a #StopRansomware alert on ransomware attacks against healthcare and public health organizations. The alert attributed the activity to DPRK state-sponsored actors and said ransomware revenue supported broader North Korean cyber priorities.
SecurityScorecard found that a Lazarus-linked IP address, 146.185.26[.]150, communicated with an IP registered to a U.S. state government. The report suggested the low-volume traffic may represent an early-stage attempt to access state resources, while noting alternative explanations remained plausible.
The observed period during which nearly 100GB of data was exfiltrated from the victim network concluded on November 11. By this stage, the attackers had established persistence, harvested credentials, and moved laterally across internal systems.
WithSecure observed nearly 100GB of data exfiltrated from the victim network over a multi-day period using encrypted SSH and SCP-based transfers. The activity supported the assessment that the campaign was focused on espionage rather than destruction.
The attackers laterally moved from the Zimbra server to a vulnerable domain-joined Windows XP device. This marked the campaign's expansion from the initial Linux mail server foothold into the Windows domain.
WithSecure observed approximately 5GB of data exfiltrated from the compromised Zimbra server, likely mailbox contents. The theft followed credential harvesting and mailbox extraction activity on the server.
On the same day, 3ByzggH211WiSPuqK6AvAGuvSE2dbduHvM and eight co-spending addresses sent the received funds to 25 other addresses. SecurityScorecard assessed the co-spending pattern may indicate common control by the same threat actors.
The wallet address bc1q8xyt4jxhw7mgqpwd6qfdjyxgvjeuz57jxrvgk9 sent 0.512 BTC to 3ByzggH211WiSPuqK6AvAGuvSE2dbduHvM. SecurityScorecard later connected the recipient and related co-spending addresses to possible laundering or support activity.
The recipient wallet bc1qhjnxutw0qvah8rea430ark2df2fcxm5xlfy52r distributed approximately the same amount it had received to three other addresses. The report said those recipient addresses had not been publicly tied to malicious activity but warranted scrutiny.
The wallet address bc1q3wzxvu8yhs8h7mlkmf7277wyklkah9k4sm9anu sent approximately 2.5 BTC to bc1qhjnxutw0qvah8rea430ark2df2fcxm5xlfy52r. SecurityScorecard later flagged the recipient chain for further investigation because it received funds from an address linked to DPRK-attributed cybercrime.
The same wallet, 1J8spy62o7z2AjQxoUpiCGnBh5cRWKVWJC, sent additional bitcoin to downstream addresses including 126JwZtwEPRuQgcPZqVPSuN1XBPUyMxjho. One recipient later forwarded roughly equivalent amounts to addresses identified as likely laundering destinations.
A bitcoin wallet address listed in later DPRK ransomware reporting, 1J8spy62o7z2AjQxoUpiCGnBh5cRWKVWJC, sent funds to multiple downstream wallet addresses. SecurityScorecard later assessed some of these transfers as likely part of laundering activity.
SecurityScorecard published analysis enriching a CISA DPRK ransomware alert with NetFlow and blockchain data. The report highlighted possible higher-education targeting and identified downstream wallet activity assessed as likely laundering of ransomware proceeds.
SecurityScorecard published research enriching ten Lazarus-linked IP indicators from an earlier healthcare research intrusion and highlighted suspicious traffic involving U.S. state government IP addresses. The firm assessed with low confidence that the traffic may reflect targeting of state government energy-related assets.
WithSecure reported that a DPRK-linked Lazarus intrusion campaign in Q4 2022 began by exploiting unpatched internet-facing Zimbra servers using CVE-2022-27925 and CVE-2022-37042 to deploy JSP webshells. The campaign targeted medical research, energy, and related supply chains for intelligence collection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcesecurityscorecard.com
Open sourcecisa.gov
Open sourcelabs.withsecure.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **North Korean state-backed operators linked to Lazarus** (including a subgroup often tracked as **Andariel/Stonefly**) have been observed using **Medusa** ransomware in financially motivated extortion activity, including an attack on a target in the Middle East and an attempted/unsuccessful intrusion against a **U.S. healthcare** organization. The activity marks a shift from Lazarus’ previously observed ransomware usage (e.g., **Maui** and **Play**) toward leveraging a **ransomware-as-a-service (RaaS)** ecosystem; Medusa is assessed as a RaaS operated by the **Spearwing** cybercrime group, with hundreds of claimed victims and recent leak-site activity impacting U.S. healthcare and nonprofit organizations. Reporting highlighted tooling associated with the Lazarus-linked activity, mixing commodity and North Korea-linked components, including **Comebacker** (Diamond Sleet-linked), **Blindingcan** (RAT), credential theft/dumping utilities (e.g., **ChromeStealer**, **Mimikatz**), and network/proxy tooling (e.g., `curl`, **RP_Proxy**). Separate items in the set covered unrelated ransomware and threat activity: **Everest** ransomware’s claimed theft of patient data via a third-party supplier affecting Vikor Scientific/Vanta Diagnostics, a disruptive ransomware incident at the **University of Mississippi Medical Center**, and broader commentary on ransomware geopolitics and sector targeting; these do not provide additional corroboration on the Lazarus–Medusa linkage itself.
Jun 29, 2026
Researchers reported multiple **DPRK-linked intrusion campaigns** tied to **Lazarus** and **Kimsuky**, highlighting new malware, refreshed delivery chains, and reusable infrastructure. Gen Digital identified Kimsuky using a new `HttpTroy` backdoor against a South Korean target via a fake VPN invoice ZIP and `.scr` dropper, while Lazarus targeted victims in Canada with an updated chain that used a new `Comebacker` variant to memory-load a new `BLINDINGCAN` RAT. Separate reporting also described Lazarus using fake hiring workflows and an NVIDIA-themed lure to trick victims into copying a malicious command that deployed credential theft tools, MeshAgent remote access, Python-based payloads, and cryptocurrency data theft components.
Aug 14, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026