Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks

**Executive summary:** North Korea-linked Lazarus Group has been observed deploying Medusa ransomware in attacks against an unnamed Middle Eastern entity and attempting an attack on a U.S. healthcare organization; the campaign leverages a mix of custom and public tools (RP_Proxy, Mimikatz, Comebacker, InfoHook, BLINDINGCAN, ChromeStealer) and aligns with a wider trend of DPRK actors partnering with RaaS operators to pursue financially motivated intrusions against healthcare and other organizations.