North Korean Cybercriminals Targeting US Healthcare Sector

In a troubling development for US healthcare facilities, cyberattacks have emerged from North Korean state-sponsored actors wielding the Medusa ransomware. This revelation comes from a joint investigation by Symantec and the Carbon Black Threat Hunter Team. The notorious Lazarus Group, linked to these attacks, operates under North Korea’s Reconnaissance General Bureau. They’re known for targeting critical infrastructure and carry out financially motivated cybercrimes against US entities.

Medusa ransomware, which first appeared in 2023, is a product of Spearwing, a cybercrime group. They use a ransomware-as-a-service model, employing affiliates to execute attacks using their encryption tools, sharing ransoms as payment. Victims endure double extortion—encryption and data theft—facing ransom demands for decryption and privacy protection. Non-payers risk their data being auctioned.

While previously deploying Maui and Play ransomware, recent shifts see Lazarus employing Medusa. Attacks have intensified, highlighting a disturbing trend targeting healthcare operations, nonprofits, and specific groups such as a mental health service and an autism-focused educational body. These incursions have demanded ransoms averaging $260,000.

The Lazarus subgroup Stonefly, also known as Andrael, primarily known for espionage, is increasingly involved in ransomware attacks against healthcare entities. As part of this campaign, the US Department of Justice has charged Rim Jong Hyok, linked with these activities and believed to generate espionage funding through ransomware.

While a specific Lazarus subgroup’s involvement remains unconfirmed, the extensive use of Medusa underscores the critical need for vigilance in protecting sensitive healthcare data. Over 366 ransomware cases have involved Medusa, impacting more than 40 healthcare institutions, pushing for heightened awareness and defense measures.

For more insights on cybersecurity threats and compliance, visit our site.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.