Therecord.Media North Korean Lazarus Group Targets US Healthcare with Medusa Ransomware
Article Content
Browse articles 
Cybersecurity researchers have identified attacks utilizing Medusa ransomware, attributed to the Lazarus group, a North Korean state-backed hacking operation. These attacks are primarily targeting U.S. healthcare organizations, with the ransomware-as-a-service operation impacting over 300 organizations since its emergence in January 2021, and claiming at least 80 additional victims by February 2025.
Ask AI about this cluster
Answers cite the sources they use
Updated 218d ago How this analysis works
Timeline
2021-01-01
Medusa ransomware-as-a-service operation emerged
2025-02-01
Medusa ransomware impacted over 300 organizations
2025-02-01
Lazarus group claimed at least 80 additional victims
2026-02-24
Current attacks on US healthcare organizations reported
More articles in this cluster (20)
Following this threat?
Track Medusa, Andariel and Blindingcan in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware… 
Ampath Laboratories Confirms Cyberattack, Disputes Claims of 80 Million Records Compromised Ampath Laboratories, a major South African pathology lab, confirmed a cyber incident detected on October 2, 2026, which reportedly involved unauthorized access to its IT environment. The threat actor, ByteToBreach, claimed to have exfiltrated data from at least 10 databases, including 80 million records, but Ampath…