Researchers Link Lazarus Actors to Medusa Ransomware Attacks
Summary
Symantec and Carbon Black report evidence linking North Korean Lazarus actors to Medusa ransomware activity, including an attack in the Middle East and an unsuccessful attempt against a U.S. healthcare organization; the responsible Lazarus subgroup is unclear.
Key points
- Symantec and Carbon Black found evidence linking Lazarus actors to a Medusa ransomware attack in the Middle East and an unsuccessful attempt against a U.S. healthcare organization.
- Medusa leak-site analysis showed claims involving four U.S. healthcare and nonprofit organizations since November 2025, but it is unknown whether Lazarus was responsible for those claims.
- The article says Medusa is operated as ransomware-as-a-service by Spearwing and that more than 366 attacks have been claimed by its affiliates.
- The attackers’ reported toolset includes Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz and RP_Proxy; the article notes some tools are not exclusive to Stonefly/Andariel.
- Symantec published file and network indicators and says Symantec Endpoint products can detect and block malicious files; users are referred to its Protection Bulletin for mitigation updates.
Article Details
- Event Type
- Reported use of Medusa ransomware by North Korean Lazarus actors in extortion attacks.
- Impact
- Symantec and Carbon Black reported evidence of Medusa deployment in an attack in the Middle East and an unsuccessful attack against a U.S. healthcare organization. The Medusa leak site showed four U.S. healthcare and nonprofit victims since November 2025, though the article says it is unknown whether Lazarus was responsible for all of them. The average ransom demand during that period was reported as $260,000.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amazonfiso[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | human-check[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | illycafe[.]my | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | illycoffee[.]my | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | markethubuk[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | sictradingc[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | trustpdfs[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| DOMAIN | zypras[.]com | Domain listed among malicious or campaign infrastructure indicators. |
| IPV4 | 23[.]27[.]124[.]228 | Network indicator listed among IP addresses associated with the reported activity. |
| IPV4 | 23[.]27[.]140[.]135 | Network indicator listed among IP addresses associated with the reported activity. |
| IPV4 | 23[.]27[.]140[.]228 | Network indicator listed among IP addresses associated with the reported activity. |
| IPV4 | 23[.]27[.]140[.]49 | Network indicator listed among IP addresses associated with the reported activity. |
| SHA256 | 0842dd5c1f79f313ea08c49d1fb227654c32485b3f413e354dbe47b8a519a120 | File hash identified as Comebacker. |
| SHA256 | 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10 | File hash identified as Medusa ransomware. |
| SHA256 | 16d57ff889aab5b8c8a646da99d5a9335177fb4c158191baa1cf199f0e818d3a | File hash for a file identified as used for DLL sideloading. |
| SHA256 | 202b03d788df6a9d22bbd2cbc01ba9c7b4a9caad0f78a4d420f8c2c30171a08d | File hash identified as Comebacker. |
| SHA256 | 3e3e0519a154266da1558e324c9097e7c39ccf88f323f2f932f204871d1b91cb | File hash identified as RP_Proxy. |
| SHA256 | 60aaf6c01ba0c15b78902fd4be12c7e5f2323ade8f9db7e9fbbb9ec0c2afc8ba | File hash identified as RP_Proxy. |
| SHA256 | 60b942bbdac625300eeb11cccba5ed44f376634f73d3bc01a17e7a758c570a8e | File hash identified as the Comebacker Loader. |
| SHA256 | 61c49c8f116cb7118dee613536085cfaa7a59d5f49c36b9ff432be7b8a7f25f0 | File hash identified as a credential stealer. |
| SHA256 | 61f3b09bcbae2fc2c98ccac7b2a0becdf5ddb28fe6a8b9c679fd574d58f8ca40 | File hash identified as Comebacker. |
| SHA256 | 7530323c3976687a329e06bb7b7f95017f2cfd408f6a5261cb2f0c6b6f18f081 | File hash identified as RP_Proxy. |
| SHA256 | 7a22880780c74b212e36ebb871af4af26a620326c456cf96a3dfb1481ee436cc | File hash identified as a loader. |
| SHA256 | 8f6866532abd8400d244d0441be097f8209065ac43d9f864b2a6894f9da2880a | File hash identified as Comebacker. |
| SHA256 | a12c84dabaffa868507807c645f7f0769ac848cc575a8c3b42dfb791aa5caeef | File hash identified as Comebacker. |
| SHA256 | ab3e3a8673ba5da40b325b160a782cf2f03547d9b489e87d9546da35a65d62d6 | File hash identified as an SSH Loader. |
| SHA256 | bf27c5e2591febe90e52cd99231526a342bc423000fe87cce44ef1c3acaeeab5 | File hash identified as Comebacker. |
| SHA256 | ce4fcb97ada09a42c03c3456c5fe09d805948a95efaf365eb1cd2b4e82013990 | File hash identified as RP_Proxy. |
| SHA256 | db98d087d4cdb2a82096df424f86edea8d4730543a2005f43bede9ffc6123791 | File hash identified as Mimikatz. |
| SHA256 | e24e4c949894b08a66b925b6c55f12d1b3c69adc95b79e99a31315e289d193fc | File hash identified as ChromeStealer. |
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz was identified as credential-dumping tooling used to harvest credentials.T1071.001 · Web ProtocolsCurl and similar tools were described as transferring data over network protocols.T1090 · ProxyRP_Proxy was identified as a custom proxying tool.T1105 · Ingress Tool TransferLoaders and backdoors, including Comebacker, were used to deploy or load additional tooling.T1486 · Data Encrypted for ImpactMedusa ransomware was used to encrypt victims' data and extort them.T1555.003 · Credentials from Web BrowsersChromeStealer was identified as a tool for extracting stored Chrome passwords.T1574.002 · DLL Side-LoadingA file identified in the article was used for DLL sideloading to run malicious code.
People
Threat Actors
AndarielThe article identifies Andariel as an alternate name for Stonefly, a Lazarus subgroup linked to ransomware and extortion campaigns.LazarusThe article attributes Medusa ransomware attacks to North Korean state-backed Lazarus actors, while noting that the responsible Lazarus subgroup is unclear.MedusaThe article identifies Spearwing as the cybercrime group operating Medusa ransomware as a service.StoneflyThe article describes Stonefly as a Lazarus subgroup involved in ransomware and extortion campaigns and explicitly identifies Andariel as an alternate name for Stonefly.
Malware
BLINDINGCANObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).ComebackerObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).InfohookObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).MedusaNorth Korean state-backed Lazarus actors have deployed the Medusa ransomware and continued extortion attempts against U.S.
Vendors
Products
Tools
ChromeStealerObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).curlObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).MimikatzObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).RP_ProxyObserved attacker toolset includes custom and off-the-shelf tools: Comebacker (backdoor/loader), Blindingcan (RAT), ChromeStealer, Curl, Infohook, Mimikatz, and RP_Proxy (proxying tool).
Countries
North KoreaNorth Korea has long been involved in ransomware attacks and has been previously associated with the Maui and Play ransomware families.South KoreaIt alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.TaiwanIt alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.United StatesNorth Korean state-backed Lazarus actors have deployed the Medusa ransomware and continued extortion attempts against U.S.
Industries
DefenseIt alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.GovernmentIt alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.Healthcarehealthcare and other organizations, with Symantec and Carbon Black linking Medusa deployments and leak-site postings to recent incidents.Non-profithealthcare and non-profit victims since November 2025, including a mental-health non-profit and an educational facility for autistic children, with an average ransom demand of $260,000.TechnologyIt alleged that the group was using the proceeds of ransomware attacks to fund its espionage activities, including attacks against the defense, technology, and government sectors in the U.S., Taiwan and South Korea.