North Korean Lazarus Group Now Working With Medusa Ransomware
North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S. healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsuccessful attempt on a U.S. healthcare organization. Medusa, launched in 2023, operates as a ransomware-as-a-service. The Lazarus sub-group Stonefly has been a key player in North Korean ransomware attacks, using proceeds to fund espionage activities. Despite indictments and rewards, the attacks continue unabated. The current campaign employs various tools, including Comebacker, Blindingcan, ChromeStealer, and RP_Proxy. While the attacks bear similarities to previous Stonefly operations, the exact sub-group responsible remains unclear.
Pulse ID: 699d9c44cde3077f50063a24
Pulse Link: https://otx.alienvault.com/pulse/699d9c44cde3077f50063a24
Pulse Author: AlienVault
Created: 2026-02-24 12:40:36
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CarbonBlack #Chrome #Comebacker #CyberSecurity #Espionage #Extortion #Healthcare #InfoSec #Korea #Lazarus #MiddleEast #NorthKorea #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Symantec #bot #AlienVault





