Medusa Ransomware distributed by the Lazarus threat group

Back Broadcom

Medusa Ransomware distributed by the Lazarus threat group

Broadcom • February 24, 2026

Share: View original

North Korean state-backed attackers are now using the Medusa ransomware and are continuing to mount extortion attacks on the U.S. healthcare ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Lazarus Group Targets US Healthcare with Medusa Ransomware Cybersecurity researchers have identified attacks utilizing Medusa ransomware, attributed to the Lazarus group, a North Korean state-backed hacking operation. These attacks are primarily targeting U.S. healthcare organizations, with the ransomware-as-a-service operation impacting over 300 organizations since its emergence in January 2021, and claiming at least 80 additional victims by February 2025. 20 sources 49

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Ransomware Groups (1)