North Korea’s Lazarus Group Deploys Medusa Ransomware Against U.S. Healthcare

The Threat Hunter Team investigation links North Korean Lazarus affiliates (including Stonefly/Andariel) to a sustained Medusa ransomware campaign—deployed via Spearwing's RaaS—that has claimed over 366 attacks and targeted U.S. healthcare and vulnerable educational facilities, demanding an average of roughly $260,000; actors use a mix of custom backdoors and publicly available tools (Comebacker, Blindingcan, ChromeStealer, Mimikatz) to conduct intrusions, credential theft, and extortion to fund espionage.