{"id":43883,"date":"2026-02-24T17:54:27","date_gmt":"2026-02-24T09:54:27","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/24\/north-korean-lazarus-group-linked-to-medusa-ransomware-attacks\/"},"modified":"2026-02-24T17:54:27","modified_gmt":"2026-02-24T09:54:27","slug":"north-korean-lazarus-group-linked-to-medusa-ransomware-attacks","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/24\/north-korean-lazarus-group-linked-to-medusa-ransomware-attacks\/","title":{"rendered":"North Korean Lazarus group linked to Medusa ransomware attacks"},"content":{"rendered":"\n

\"North<\/p>\n

North Korean state-backed hackers associated with the Lazarus threat group are targeting U.S. healthcare organizations in extortion attacks using the Medusa ransomware.<\/p>\n

The Medusa ransomware-as-a-service (RaaS) operation emerged in January 2021, and by February 2025, it impacted over 300 organizations<\/a> in various critical infrastructure sectors. Since then, the gang claimed at least another 80 victims.<\/p>\n

North Korean threat actors have previously been linked to other ransomware strains such as HolyGhost<\/a>, PLAY<\/a>, Maui<\/a>, Qilin<\/a>, as well as other malware families<\/a>. However, this is the first time security researchers have associated the actor with Medusa.<\/p>\n

\"North<\/a> <\/div>\n

In a report today, enterprise cybersecurity company Symantec says that a Lazarus subgroup, possibly Andariel\/Stonefly, is now using Medusa in financially-motivated cyberattacks targeting U.S. healthcare providers.<\/p>\n

According to the researchers, the toolset used in these attacks also shows some association with Diamond Sleet, another North Korean group that typically targets media, defense, and IT industries.<\/p>\n

However, some of the utilities seen in the Medusa ransomware attacks are commodity tools:<\/p>\n