Security researchers have linked the North Korean state-backed Lazarus Group—specifically its subgroup Andariel (also known as Stonefly) —to a series of extortion attacks using Medusa ransomware. This marks the first time this notorious threat actor has been officially associated with the Medusa strain.

Key Findings of the Attacks

• Target Sector: The campaign primarily targets U.S. healthcare organizations.
• Financial Motivation: Unlike historical espionage-only missions, these attacks are purely financially motivated, likely intended to generate illicit revenue for the North Korean regime.
• Attribution Indicators: Symantec attributed the attacks to North Korea based on the use of custom tools exclusive to Lazarus, including a specialized backdoor and unique malware.
• Collaboration: The toolset shows overlap with Diamond Sleet (another North Korean group), suggesting increased coordination among the regime’s cyber units.

Background on Medusa Ransomware

• Operation Model: Medusa operates as a Ransomware-as-a-Service (RaaS) model. It first emerged in early 2021 and has impacted hundreds of organizations globally.
• Tactics: The group maintains a “Medusa Blog” on the dark web where they leak sensitive data. While they use an affiliate model, the core developers centrally control ransom negotiations.
• Geographic Focus: The Medusa group is believed to operate out of Russia or allied states, as they typically avoid targeting organizations within the Commonwealth of Independent States.