North Korean Lazarus Group Adopts Medusa Ransomware in Global Attacks

Symantec and Carbon Black research shows North Korea’s Lazarus Group has adopted the Medusa ransomware-as-a-service, executing multi-stage intrusions that disable defenses, deploy backdoors (Blindingcan, Comebacker), steal credentials (ChromeStealer, Mimikatz), stage/exfiltrate sensitive data (Infohook, RP_Proxy), and finally encrypt systems with Medusa; targets include healthcare and social-service organizations and ransom demands average around $260,000.