CampaignPublished 24 Feb 2026Updated 26 Mar 2026

North Korean Lazarus Group Now Working With Medusa Ransomware

Source AlienVault OTX General

Description

North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S.healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsuccessful attempt on a U.S.healthcare organization. Medusa, launched in 2023, operates as a ransomware-as-a-service. The Lazarus sub-group Stonefly has been a key player in North Korean ransomware attacks, using proceeds to fund espionage activities. Despite indictments and rewards, the attacks continue unabated. The current campaign employs various tools, including Comebacker, Blindingcan, ChromeStealer, and RP_Proxy. While the attacks bear similarities to previous Stonefly operations, the exact sub-group responsible remains unclear.

Impact

The impact of this threat is significant, particularly for healthcare organizations that rely on continuous availability and confidentiality of sensitive patient data. Successful ransomware deployment can lead to operational disruption, loss of critical healthcare services, exposure of protected health information (PHI), and financial losses due to ransom payments and remediation costs. Beyond healthcare, other sectors in the Middle East and globally may face similar risks. The use of ransomware by a nation-state actor like Lazarus also raises concerns about the dual use of cybercrime for espionage funding, potentially increasing the frequency and sophistication of attacks. Organizations may suffer reputational damage, regulatory penalties, and long-term operational setbacks. The persistent nature of these campaigns despite law enforcement actions indicates a sustained threat that could evolve with new tactics and tools, increasing the risk of widespread disruption and data compromise.

Defensive guidance

Organizations should implement a multi-layered defense strategy tailored to the tactics used by Lazarus and Medusa ransomware affiliates. This includes: 1) Enforcing strict network segmentation to limit lateral movement, especially isolating critical healthcare systems. 2) Deploying advanced endpoint detection and response (EDR) solutions capable of detecting tools like Mimikatz and Blindingcan. 3) Regularly auditing and restricting privileged account usage and implementing multi-factor authentication (MFA) to reduce credential theft impact. 4) Conducting continuous vulnerability management and patching, focusing on known exploited vulnerabilities related to privilege escalation and remote code execution. 5) Monitoring for indicators of compromise related to ChromeStealer and RP_Proxy activity, including unusual proxy or network traffic patterns. 6) Implementing robust backup and recovery processes, ensuring backups are offline and immutable to withstand ransomware encryption. 7) Conducting targeted threat hunting exercises for Lazarus-related TTPs and maintaining updated threat intelligence feeds. 8) Training staff on phishing and social engineering risks to reduce initial infection vectors. 9) Collaborating with industry information sharing groups and government cybersecurity agencies for timely alerts and response coordination. These measures, combined with incident response preparedness, will enhance resilience against this sophisticated ransomware campaign.

Summary

The Lazarus Group, a North Korean state-sponsored threat actor, has incorporated Medusa ransomware into its extortion campaigns, particularly targeting the U.S. healthcare sector and Middle Eastern entities. Medusa ransomware, introduced in 2023 as ransomware-as-a-service, allows affiliates to deploy ransomware with modular capabilities. The Stonefly sub-group of Lazarus, known for ransomware attacks funding espionage, is implicated in these operations. The campaign uses a suite of tools including Comebacker (likely for persistence or backdoor access), Blindingcan (a remote access trojan), ChromeStealer (credential theft), and RP_Proxy (proxy tool for network evasion). Techniques observed include credential dumping (Mimikatz), lateral movement, privilege escalation, and exploitation of vulnerabilities, consistent with MITRE ATT&CK techniques such as T1003 (Credential Dumping), T1543 (Create or Modify System Process), and T1486 (Data Encrypted for Impact). The attackers aim to encrypt critical systems to extort ransom payments, which are then used to finance further espionage activities. Despite international law enforcement efforts, including indictments and rewards for Lazarus members, these ransomware campaigns persist. The attacks demonstrate a blend of espionage and financially motivated ransomware tactics, highlighting the evolving threat landscape posed by nation-state actors leveraging ransomware-as-a-service platforms.

Indicators of compromise

Domains 8

amazonfiso.com
human-check.com
illycafe.my
illycoffee.my
markethubuk.com
sictradingc.com
trustpdfs.com
zypras.com

IP addresses 4

23.27.124.228
23.27.140.135
23.27.140.228
23.27.140.49

Hashes 50

9acfd35188637ac257b56f7bf0c53b0c
c14935ba8c6abdfa6202df446e8136022f82731e
0842dd5c1f79f313ea08c49d1fb227654c32485b3f413e354dbe47b8a519a120
15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10
16d57ff889aab5b8c8a646da99d5a9335177fb4c158191baa1cf199f0e818d3a
18049366331a5f0afd54c2ca84e6ed302e81d58a162673715fee865541d53b11
202b03d788df6a9d22bbd2cbc01ba9c7b4a9caad0f78a4d420f8c2c30171a08d
313ce75f0f47e2a8fd66120fcbcaa6226fc0c4862b585b8e04850153f97bc4a3
35a11a68b0ce862bdc7450735237e56cf70156870b0527ec624f0a57076c09c7
3b8850bad0cb3ebae477b3787844b892bb0e4f7bd9c9e8b507898a726e7e2763

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Mar 2026, 18:05 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 8

IP addresses 4

Hashes 50

Community reviews

Related threats