North Korea Lazarus uses Medusa Ransomware Attacks

Back Cybersecurity-Insiders

North Korea Lazarus uses Medusa Ransomware Attacks

Cybersecurity-Insiders • February 24, 2026

Share: View original

The notorious North Korea–linked hacking collective Lazarus Group, long associated with high-profile cyberattacks and ransomware campaigns, ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Lazarus Group Targets US Healthcare with Medusa Ransomware Cybersecurity researchers have identified attacks utilizing Medusa ransomware, attributed to the Lazarus group, a North Korean state-backed hacking operation. These attacks are primarily targeting U.S. healthcare organizations, with the ransomware-as-a-service operation impacting over 300 organizations since its emergence in January 2021, and claiming at least 80 additional victims by February 2025. 20 sources 49

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

T1486 - Data Encrypted for Impact

Ransomware Groups (1)