Symantec Links North Korean Lazarus Actors to Medusa Ransomware Attacks
Summary
Symantec linked Lazarus actors to Medusa ransomware attacks on organizations in the Middle East and U.S. Researchers cited custom tools for attribution and said North Korean actors may be shifting toward ransomware-as-a-service.
Key points
- Symantec reported Medusa ransomware deployments against a company in the Middle East and a U.S. healthcare organization.
- Researchers attributed the activity to Lazarus based on custom tools, including a backdoor and a Chrome password extractor.
- Symantec analyst Dick O’Brien said the attacks may have involved Andariel, but he could not confirm that attribution.
- The report describes a shift from North Korean actors’ use of strains such as Maui toward ransomware-as-a-service offerings.
- Experts say Medusa has been linked to more than 350 attacks since 2023.
Article Details
- Event Type
- Symantec researchers attributed financially motivated Medusa ransomware attacks against at least two institutions to North Korean state-backed Lazarus actors, based on the use of custom tools. The article reports a possible shift from North Korean-developed ransomware to ransomware-as-a-service.
- Impact
- The reported targets included a company in the Middle East and a U.S. healthcare organization; the article does not specify the operational impact of those Medusa attacks. Separately, U.S. agencies attributed earlier Maui ransomware attacks to Rim Jong Hyok and other Andariel actors, reporting that attacks disrupted healthcare services and encrypted systems used for medical testing and electronic medical records.
MITRE ATT&CK
People
Threat Actors
AndarielThe article describes Andariel as a subgroup within Lazarus. Dick O'Brien said he could not confirm, but believed, that Andariel launched the recent Medusa attacks; U.S. agencies have also attributed earlier Maui ransomware attacks to Andariel actors.LazarusSymantec researchers attributed the reported Medusa attacks to Lazarus actors based on custom tools they said were used exclusively by the group.MedusaThe article says experts tie Medusa attacks to the larger cybercrime group known as Spearwing.Rim Jong HyokThe article identifies him as an alleged Andariel member and reports that U.S. agencies identified him as responsible for Maui ransomware attacks in 2021 and 2022.
Malware
MauiThe report indicates a shift from in-house strains like Maui to ransomware-as-a-service offerings and attributes the intrusions using Lazarus-specific tools.MedusaSymantec researchers linked North Korean state-backed Lazarus actors to financially motivated deployments of Medusa ransomware against at least two institutions, including a company in the Middle East and a U.S.PlayDick O’Brien, principal intelligence analyst atSymantec, noted that North Korean actors were previously seen using ransomware strains like Maui and Play, but this is the first time they had been tracked using Medusa.
Products
Countries
Chinaagencies said Rim used the ransoms from the attacks to buy servers that were then used in other cyber espionage hacks against government organizations and customers in the U.S., South Korea and China.North KoreaHackers tied to one of North Korea’s most sophisticated state-backed groups have been seen deploying Medusa ransomware in financially-motivated attacks on at least two institutions.South Koreaagencies said Rim used the ransoms from the attacks to buy servers that were then used in other cyber espionage hacks against government organizations and customers in the U.S., South Korea and China.United StatesSymantec researchers linked North Korean state-backed Lazarus actors to financially motivated deployments of Medusa ransomware against at least two institutions, including a company in the Middle East and a U.S.
Industries
DefenseThe FBI said investigators found that Rim and other Andariel actors victimized five healthcare providers, four U.S.-based defense contractors, two U.S.Governmentagencies said Rim used the ransoms from the attacks to buy servers that were then used in other cyber espionage hacks against government organizations and customers in the U.S., South Korea and China.Healthcarehealthcare organization. The report indicates a shift from in-house strains like Maui to ransomware-as-a-service offerings and attributes the intrusions using Lazarus-specific tools.