Signal
Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-02-24 11:00 UTCUpdated 2026-02-24 14:30 UTC
rss
north_korean_lazarus
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
Report: Lazarus Group Pivoting to Medusa Ransomware for Extortion Attacks North Korean-state backed Lazarus Group hackers are using Medusa ransomware in extortion attacks on U.S. healthcare entities despite a 2024 U.S. indictment of Rim Jong Hyok, an alleged member of the Lazarus subgroup Stonefly, according to a...
Score total
1.75
Momentum 24h
6
Posts
6
Origins
6
Source types
1
Duplicate ratio
0%
All evidence
All evidence
North Korean Lazarus Group Expands Ransomware Activity With Medusa
Infosecurity Magazine · infosecurity-magazine.com · 2026-02-24 14:30 UTC
Lazarus hackers adopt Medusa ransomware for extortion campaigns, targeting healthcare and nonprofits
DataBreaches.net · databreaches.net · 2026-02-24 14:12 UTC
North Korean Hackers Continue to Target US Healthcare
BankInfoSecurity · bankinfosecurity.com · 2026-02-24 13:17 UTC
Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks
The Hacker News · thehackernews.com · 2026-02-24 11:52 UTC
North Korean state hackers seen using Medusa ransomware in attacks on US, Middle East
The Record (Recorded Future News) · therecord.media · 2026-02-24 11:27 UTC
North Korean Lazarus group linked to Medusa ransomware attacks
bleepingcomputer_all · bleepingcomputer.com · 2026-02-24 11:00 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 6Origin domains: 6Duplicates: -
Showing 6 / 0
Top publishers (this list)
- Infosecurity Magazine (1)
- DataBreaches.net (1)
- BankInfoSecurity (1)
- The Hacker News (1)
- The Record (Recorded Future News) (1)
- bleepingcomputer_all (1)
Top origin domains (this list)
- infosecurity-magazine.com (1)
- databreaches.net (1)
- bankinfosecurity.com (1)
- thehackernews.com (1)
- therecord.media (1)
- bleepingcomputer.com (1)