# Lazarus Group Medusa Ransomware — North Korean State-Backed Extortion Targeting US Healthcare and Middle East

> North Korean Lazarus Group (Stonefly/Andariel sub-group) operating as Medusa RaaS affiliates, targeting US healthcare organizations and Middle Eastern entities. Third known DPRK ransomware family partnership after Maui and Play. Custom toolset includes Comebacker backdoor, Blindingcan RAT, ChromeStealer, RP_Proxy. Medusa has claimed 366+ victims since 2023. Ransom demands averaging $260K against healthcare/non-profit targets.

- **Published:** 2026-02-24T12:00:00Z
- **Last reviewed:** 2026-02-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0140
- **ID:** TL-2026-0140
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-48788, CVE-2024-1709

## Description

Symantec/Broadcom Threat Hunter Team has uncovered evidence that North Korean state-backed Lazarus Group actors are now operating as Medusa ransomware-as-a-service (RaaS) affiliates, deploying Medusa ransomware in attacks against organizations in the Middle East and US healthcare sector.

This represents North Korea's third known ransomware family partnership, following previous collaborations with the Maui ransomware family and Play ransomware group (reported by Palo Alto Unit 42 in October 2024). The attacks are attributed to the Stonefly (Andariel) sub-group of Lazarus, although Symantec notes that specific tools like the Comebacker backdoor have also been associated with the Pompilus (Diamond Sleet) sub-group.

The Medusa ransomware operation, run by the Spearwing cybercrime group, has been active since June 2021 and operates as a RaaS platform where affiliates deploy the ransomware in exchange for a percentage of ransom payments. More than 366 attacks have been claimed by Medusa operators as of February 2025. Analysis of the Medusa leak site reveals attacks against four healthcare and non-profit organizations in the US since November 2025, including a non-profit in the mental health sector and an educational facility for autistic children, with an average ransom demand of $260,000.

The motivation behind Lazarus/Stonefly's involvement in ransomware was illuminated by a US DOJ indictment in July 2025, which charged a North Korean national named Rim Jong Hyok with ransomware attacks targeting US hospitals. The indictment alleged that proceeds from ransomware operations fund espionage activities targeting defense, technology, and government sectors in the US, Taiwan, and South Korea. Despite the indictment and a $10 million FBI reward for information on Rim, Stonefly continued operations.

The attacker toolset combines custom Lazarus malware with commodity tools: Comebacker (custom backdoor/loader exclusively associated with Lazarus), Blindingcan (RAT), ChromeStealer (browser credential theft), Infohook (information stealer), Mimikatz (credential dumping), RP_Proxy (custom proxying tool), and curl for data transfer. Medusa's broader operational TTPs include initial access via phishing and exploitation of known vulnerabilities (CVE-2024-1709 ScreenConnect, CVE-2023-48788 Fortinet EMS), living-off-the-land techniques, PowerShell with multiple evasion layers, PsExec for lateral movement, Rclone for exfiltration, and vulnerable driver exploitation to kill EDR tools.

The CISA advisory AA25-071a (March 2025) provides comprehensive TTPs and IOCs for Medusa operations broadly. Symantec's February 2026 report specifically ties Lazarus to these operations with 40+ file IOCs and 12 network indicators unique to the North Korean-affiliated campaign.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1070.003 Clear Command History
- T1685 Disable or Modify Tools
- T1218 System Binary Proxy Execution
- T1003.001 LSASS Memory
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1083 File and Directory Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Symantec: North Korean Lazarus Group Now Working With Medusa Ransomware](https://www.security.com/threat-intelligence/lazarus-medusa-ransomware)
- [CISA Advisory AA25-071A: #StopRansomware: Medusa Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a)
- [US DOJ Indictment: Rim Jong Hyok — Hospital Ransomware](https://www.justice.gov/opa/pr/north-korean-government-hacker-charged-involvement-ransomware-attacks-targeting-us-hospitals)
- [FBI Wanted: Rim Jong Hyok ($10M Reward)](https://www.fbi.gov/wanted/cyber/rim-jong-hyok/download.pdf)
- [Symantec: Stonefly North Korea Extortion (Oct 2024)](https://www.security.com/threat-intelligence/stonefly-north-korea-extortion)
- [Unit 42: North Korean Threat Group Collaborates with Play Ransomware](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/)
- [Microsoft: ZINC Attacks Against Security Researchers (Comebacker)](https://www.microsoft.com/en-us/security/blog/2021/01/28/zinc-attacks-against-security-researchers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0140