North Korean Lazarus Group Collaborates with Medusa Ransomware

Despite facing intense scrutiny, North Korean cybercriminals are undeterred, now targeting the U.S. healthcare sector with Medusa ransomware. Previously linked with Maui and Play ransomware, they’ve shifted tactics as the Symantec and Carbon Black Threat Hunter Team discovered Medusa’s use against a Middle Eastern target and a U.S. healthcare entity.

Medusa, launched by the Spearwing cybercrime collective in 2023, is a ransomware-as-a-service model. Affiliate attackers use it in exchange for a share of the ransom. Reports show that Medusa’s affiliates have claimed over 366 incidents, impacting four U.S. healthcare and non-profit organizations since November 2025.

A Shift in Cyber Strategy

The Lazarus group, particularly its Stonefly sub-faction, transitioned from espionage to a more direct involvement in ransomware. Stonefly gained notoriety following the indictment of North Korean hacker Rim Jong Hyok by the U.S. Justice Department, linking him to hospital attacks. Proceeds from these attacks support espionage in defense, technology, and government sectors.

Despite legal pressures, their activities remain vigorous. Recent collaborations with the Play ransomware group highlight their evolving strategies.

Tools of the Cybercriminal Trade

The Lazarus group armory includes:

• Comebacker: A bespoke backdoor.
• Blindingcan: A remote access Trojan.
• ChromeStealer: Extracts saved Chrome passwords.
• Curl: An open-source transfer tool.
• Infohook: For information theft.
• Mimikatz: Credential dumping utility.
• RP_Proxy: Custom proxying tool.

While Medusa attacks are linked to Lazarus, the exact subgroup involved remains mysterious.

Implications of North Korean Cyber Activities

North Korea’s use of Medusa underscores a relentless drive towards cybercrime, undeterred by affecting the healthcare sector. This persistence demands robust defenses. For recent protection updates, check the Symantec Protection Bulletin.

Qsentinel Call-To-Action:

Stay informed and protect your organization by subscribing to Qsentinel’s cybersecurity alerts. Empower your defenses today for a safer tomorrow.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.