Symantec Links Lazarus Subgroup to Medusa Ransomware Attacks
Summary
Symantec links some Medusa ransomware attacks on U.S. healthcare providers to a Lazarus subgroup possibly associated with Andariel/Stonefly, while noting that not all attacks can be confidently attributed to Lazarus.
Key points
- Symantec attributes some Medusa ransomware attacks against U.S. healthcare providers to a Lazarus subgroup, possibly Andariel/Stonefly.
- The article says Medusa has affected more than 300 organizations since emerging in 2021, with at least 80 additional victims claimed since February 2025.
- Medusa’s leak site listed four U.S. healthcare and nonprofit victims since early November 2025, including an educational facility for autistic children.
- Tools observed in the attacks include Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy and curl.
- Symantec researchers say Medusa ransom demands can reach $15 million, with an average of about $260,000.
- The article says stolen funds support espionage targeting defense, technology and government entities in the U.S., Taiwan and South Korea.
Article Details
- Event Type
- Reported use of Medusa ransomware in financially motivated extortion attacks, with Symantec linking some activity to a Lazarus subgroup possibly associated with Andariel/Stonefly.
- Impact
- Medusa had impacted over 300 organizations by February 2025, and the group claimed at least 80 additional victims afterward. The article reports attacks against U.S. healthcare and nonprofit organizations, including an educational facility for autistic children. Ransom demands can reach $15 million, with an average around $260,000. Stolen funds are reportedly used to support espionage against defense, technology, and government targets in the U.S., Taiwan, and South Korea. Symantec cautions that not all Medusa attacks can be confidently attributed to Lazarus.
Threat Actors
AndarielPossibly associated with the Lazarus subgroup that Symantec links to Medusa attacks; this attribution is presented as uncertain.Diamond SleetThe researchers say the toolset used in the Medusa attacks shows some association with this North Korean group; Comebacker is described as linked to Diamond Sleet.LazarusSymantec attributes some Medusa ransomware extortion activity to a Lazarus subgroup; the article says not all Medusa attacks can be confidently attributed to Lazarus.StoneflyPossibly associated with the Lazarus subgroup that Symantec links to Medusa attacks; this attribution is presented as uncertain.
Malware
BLINDINGCANAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.ChromeStealerAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.ComebackerAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.InfohookAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.MedusaNorth Korean state-backed Lazarus operators are using the Medusa RaaS to carry out extortion attacks against U.S.
Vendors
Tools
curlAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.MimikatzAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.RP_ProxyAttackers used both custom and commodity tools such as Comebacker, Blindingcan, ChromeStealer, Infohook, Mimikatz, RP_Proxy, and curl.
Countries
South KoreaRansom demands reach up to $15 million (average around $260,000), and stolen funds are used to support espionage against U.S., Taiwan, and South Korea targets.TaiwanRansom demands reach up to $15 million (average around $260,000), and stolen funds are used to support espionage against U.S., Taiwan, and South Korea targets.United StatesNorth Korean state-backed Lazarus operators are using the Medusa RaaS to carry out extortion attacks against U.S.
Industries
DefenseThe campaigns use a mix of custom and commodity tools and funnel stolen funds to support espionage against defense, technology, and government targets.GovernmentThe campaigns use a mix of custom and commodity tools and funnel stolen funds to support espionage against defense, technology, and government targets.Healthcarehealthcare and non-profit organizations, with Symantec attributing the activity to a Lazarus subgroup possibly linked to Andariel/Stonefly.TechnologyThe campaigns use a mix of custom and commodity tools and funnel stolen funds to support espionage against defense, technology, and government targets.