{
  "name": "North Korean Lazarus Group Now Working With Medusa Ransomware",
  "slug": "north-korean-lazarus-group-now-working-with-medusa-ransomware",
  "description": "North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S. healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsuccessful attempt on a U.S. healthcare organization. Medusa, launched in 2023, operates as a ransomware-as-a-service. The Lazarus sub-group Stonefly has been a key player in North Korean ransomware attacks, using proceeds to fund espionage activities. Despite indictments and rewards, the attacks continue unabated. The current campaign employs various tools, including Comebacker, Blindingcan, ChromeStealer, and RP_Proxy. While the attacks bear similarities to previous Stonefly operations, the exact sub-group responsible remains unclear.",
  "published": "2026-02-24T11:40:36+00:00",
  "created_at": "2026-02-24T11:40:36+00:00",
  "modified_at": "2026-02-24T19:54:15+00:00",
  "created_at_opencti": "2026-02-24T11:40:36+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-02-24",
    "blindingcan",
    "chromestealer",
    "comebacker",
    "extortion",
    "healthcare",
    "infohook",
    "medusa",
    "mimikatz",
    "north korea",
    "ransomware",
    "rp_proxy",
    "stonefly"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "23.27.140.228"
      },
      {
        "id": "",
        "name": "23.27.140.135"
      },
      {
        "id": "",
        "name": "23.27.124.228"
      },
      {
        "id": "",
        "name": "23.27.140.49"
      },
      {
        "id": "",
        "name": "18049366331a5f0afd54c2ca84e6ed302e81d58a162673715fee865541d53b11"
      },
      {
        "id": "",
        "name": "61f3b09bcbae2fc2c98ccac7b2a0becdf5ddb28fe6a8b9c679fd574d58f8ca40"
      },
      {
        "id": "",
        "name": "3b8850bad0cb3ebae477b3787844b892bb0e4f7bd9c9e8b507898a726e7e2763"
      },
      {
        "id": "",
        "name": "df1b9ec31fa4578dee7668207064de7185798801bb032c715aa24cce7e35bcda"
      },
      {
        "id": "",
        "name": "db98d087d4cdb2a82096df424f86edea8d4730543a2005f43bede9ffc6123791"
      },
      {
        "id": "",
        "name": "cf5e38d65bef38654080635fcb76890e3e0548626b0598bc8090b18116220389"
      },
      {
        "id": "",
        "name": "61c49c8f116cb7118dee613536085cfaa7a59d5f49c36b9ff432be7b8a7f25f0"
      },
      {
        "id": "",
        "name": "932b9ec79c782f06b3c8d267af916df41328ddb8235d021ea7f945dc4082d991"
      },
      {
        "id": "",
        "name": "416545b9e844d3d924e162951a8ee885f3885e054a196ccdc659fd9d1f1911a6"
      },
      {
        "id": "",
        "name": "d80daa7b30732b2b71d63a5881a254d12eb0d499a015dc4c98602caa2001d2a3"
      },
      {
        "id": "",
        "name": "ab3e3a8673ba5da40b325b160a782cf2f03547d9b489e87d9546da35a65d62d6"
      },
      {
        "id": "",
        "name": "9cb10407ca3c9e8c1a069ebb4c677d8889117c1bc5206fbf16f47ebb13ef34b9"
      },
      {
        "id": "",
        "name": "55cb4a851372237a5ba4bf187e37b0d599f3ffa13ac17464130744614353bd07"
      },
      {
        "id": "",
        "name": "313ce75f0f47e2a8fd66120fcbcaa6226fc0c4862b585b8e04850153f97bc4a3"
      },
      {
        "id": "",
        "name": "a12c84dabaffa868507807c645f7f0769ac848cc575a8c3b42dfb791aa5caeef"
      },
      {
        "id": "",
        "name": "16d57ff889aab5b8c8a646da99d5a9335177fb4c158191baa1cf199f0e818d3a"
      },
      {
        "id": "",
        "name": "8f6866532abd8400d244d0441be097f8209065ac43d9f864b2a6894f9da2880a"
      },
      {
        "id": "",
        "name": "c69acc7364da828f098394b1a6907788d4fd379ed2af7d966e86a2becea4c0ad"
      },
      {
        "id": "",
        "name": "b8a9533a21127ff5005352d41581c5631598704e220120b623fad16e3ec2ae51"
      },
      {
        "id": "",
        "name": "f0f4423cd8d5ceafb4e4a18014ff4ed8913021d83bc2c3a973a419b9fe466c19"
      },
      {
        "id": "",
        "name": "84168ee4e290690985358dfc497b98a22ef279a01179b93ff4e6c9c5e1ee26e4"
      },
      {
        "id": "",
        "name": "63432828de42e43ea3715157da5439c40e5c371eefd7c1892b25f396c1018cc8"
      },
      {
        "id": "",
        "name": "bedada1c52e9bcceff8c6b542d74518afcce66f955ac6f1ab58aa43b3865fe9f"
      },
      {
        "id": "",
        "name": "bf05b1ace61aeebd251940b40624fe22a345300fc6a53a472357f9586e8e4e57"
      },
      {
        "id": "",
        "name": "e24e4c949894b08a66b925b6c55f12d1b3c69adc95b79e99a31315e289d193fc"
      },
      {
        "id": "",
        "name": "ce4fcb97ada09a42c03c3456c5fe09d805948a95efaf365eb1cd2b4e82013990"
      },
      {
        "id": "",
        "name": "0842dd5c1f79f313ea08c49d1fb227654c32485b3f413e354dbe47b8a519a120"
      },
      {
        "id": "",
        "name": "a55bc262c5218c6bdaebcf4618154312ff0540b00c382ab34e805699ce3fcc31"
      },
      {
        "id": "",
        "name": "fdd4b78aa4e0914f3bcdc2632338ebbd300fdc3f05a3df85a5a3067f97627e45"
      },
      {
        "id": "",
        "name": "cfe33c6faacc824fcb475d450d6ba19316884fad4c85f563a330a86d03ecff0c"
      },
      {
        "id": "",
        "name": "3e3e0519a154266da1558e324c9097e7c39ccf88f323f2f932f204871d1b91cb"
      },
      {
        "id": "",
        "name": "202b03d788df6a9d22bbd2cbc01ba9c7b4a9caad0f78a4d420f8c2c30171a08d"
      },
      {
        "id": "",
        "name": "bf27c5e2591febe90e52cd99231526a342bc423000fe87cce44ef1c3acaeeab5"
      },
      {
        "id": "",
        "name": "918e2a5a01fdb0ad462b0242e4f23d51111031052a1ebd6a32d22be9cbd8dfb8"
      },
      {
        "id": "",
        "name": "60aaf6c01ba0c15b78902fd4be12c7e5f2323ade8f9db7e9fbbb9ec0c2afc8ba"
      },
      {
        "id": "",
        "name": "a957b5dd5f555be8431df3f35b707c149b83436d19cc3f8bbd867317a6f624b1"
      },
      {
        "id": "",
        "name": "a670d8818a6efe2919c18c740ef4f3478551b28481d0a1591539be45ceca2171"
      },
      {
        "id": "",
        "name": "60b942bbdac625300eeb11cccba5ed44f376634f73d3bc01a17e7a758c570a8e"
      },
      {
        "id": "",
        "name": "6428ef885c54b8154bd86a5d849fb8cc8c04f39e72188117119b9e2832b99ee6"
      },
      {
        "id": "",
        "name": "6ad1a57ce20b422b77bab84a8daebf4e7262543742b2fdcbcacde3f7780d9046"
      },
      {
        "id": "",
        "name": "4a702c784eb997a170bea81778a770a86e61c759ff95ca0ad958ceca55c20c7b"
      },
      {
        "id": "",
        "name": "52293b53ca5209bc49f009288cf6fc80c9f787c9c735cc06e7dc6fc9fcdaf61d"
      },
      {
        "id": "",
        "name": "35a11a68b0ce862bdc7450735237e56cf70156870b0527ec624f0a57076c09c7"
      },
      {
        "id": "",
        "name": "7a22880780c74b212e36ebb871af4af26a620326c456cf96a3dfb1481ee436cc"
      },
      {
        "id": "",
        "name": "6ba46c392bdc330ceef2aeb984c63c89d673a090dd68d3258e4aa7e20e5c098d"
      },
      {
        "id": "",
        "name": "7530323c3976687a329e06bb7b7f95017f2cfd408f6a5261cb2f0c6b6f18f081"
      },
      {
        "id": "",
        "name": "b42345567556a01d34daf262f95fdeb02f259271afbea93fb684b9656d14e568"
      },
      {
        "id": "",
        "name": "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f84d0d4c-ec28-4155-b729-8e2c337a0d90",
        "name": "Lazarus Group",
        "slug": "lazarus-group"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "444de5e0-bd7f-4700-b700-26320057dd80",
        "name": "T1110"
      },
      {
        "id": "985513c3-6e7b-441f-87f7-7923e1758e9c",
        "name": "T1078.002"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "6aa7866f-9c1f-4159-938a-10a6adf41646",
        "name": "T1553"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "af9ed2e3-4663-4723-beab-c606ddc312e0",
        "name": "T1543"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Software"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Healthcare"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "markethubuk.com"
      },
      {
        "id": "",
        "name": "illycoffee.my"
      },
      {
        "id": "",
        "name": "amazonfiso.com"
      },
      {
        "id": "",
        "name": "trustpdfs.com"
      },
      {
        "id": "",
        "name": "zypras.com"
      },
      {
        "id": "",
        "name": "human-check.com"
      },
      {
        "id": "",
        "name": "illycafe.my"
      },
      {
        "id": "",
        "name": "sictradingc.com"
      }
    ]
  },
  "external_refs": [
    "https://www.security.com/blog-post/lazarus-medusa-ransomware",
    "https://otx.alienvault.com/pulse/699d9c44cde3077f50063a24"
  ]
}