Lazarus Group Picks a New Poison: Medusa Ransomware

Symantec and Carbon Black investigators attribute recent Medusa ransomware deployments to the North Korean Lazarus Group, which used additional tooling (Comebacker backdoor, Blindingcan RAT, Infohook infostealer) in attacks that targeted a large Middle Eastern organization and attempted an attack on a U.S. healthcare entity; the report notes TTPs including BYOVD/EDR-killer techniques and provides IOCs and behavioral indicators to detect and block the activity.