Theregister North Korean Intruders Target US Education and Healthcare Sectors
Article Content
Browse articles 
Digital intruders with possible links to North Korea have been infecting the US education and healthcare sectors with a new backdoor since at least December 2025. Security researchers from Cisco Talos reported that several educational institutions, including a university connected to multiple others, have been compromised, indicating a broader attack surface.
Ask AI about this cluster
Answers cite the sources they use
Updated 218d ago How this analysis works
Timeline
2025-12-01
Infections in US education and healthcare sectors began
2026-02-27
Initial reports published by The Register
2026-02-28
Further coverage and details released by The Register
More articles in this cluster (2)
Following this threat?
Track Medusa, Andariel and Dohdoor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware… 
Ampath Laboratories Confirms Cyberattack, Disputes Claims of 80 Million Records Compromised Ampath Laboratories, a major South African pathology lab, confirmed a cyber incident detected on October 2, 2026, which reportedly involved unauthorized access to its IT environment. The threat actor, ByteToBreach, claimed to have exfiltrated data from at least 10 databases, including 80 million records, but Ampath…