Lazarus Group Picks a New Poison: Medusa Ransomware

Back Darkreading

Lazarus Group Picks a New Poison: Medusa Ransomware

Darkreading •Rob Wright • February 24, 2026

Share: View original

The North Korean threat group also leveraged Comebacker backdoor, Blindingcan RAT, and info stealer Infohook in its recent attacks.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Lazarus Group Targets US Healthcare with Medusa Ransomware Cybersecurity researchers have identified attacks utilizing Medusa ransomware, attributed to the Lazarus group, a North Korean state-backed hacking operation. These attacks are primarily targeting U.S. healthcare organizations, with the ransomware-as-a-service operation impacting over 300 organizations since its emergence in January 2021, and claiming at least 80 additional victims by February 2025. 20 sources 49

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (3)

Blindingcan Comebacker Infohook

Ransomware Groups (1)