Lazarus Goes Affiliate: North Korea’s RaaS Pivot with Medusa Ransomware

When Nation-States Join the Affiliate Program

For years, the line between nation-state cyber operations and criminal ransomware was blurry but directional: state actors developed custom tools, criminals rented them. That model has now inverted.

Symantec and Carbon Black uncovered evidence in February 2026 that North Korea’s Lazarus Group — one of the most capable and well-resourced state-sponsored hacking operations in the world — has begun deploying Medusa ransomware as an affiliate. Not as a developer. Not as an operator of custom-built tools. As a customer of an existing ransomware-as-a-service (RaaS) platform.

The Medusa ransomware gang first emerged in June 2021 as a closed operation, rose to prominence in early 2023, and has since expanded to a more open RaaS model allowing affiliates to deploy the malware in exchange for a cut of ransom proceeds. To date, Medusa has claimed more than 366 victims across multiple sectors.

Symantec assessed the observed Medusa activity was “undoubtedly” the work of Lazarus, based on the presence of Comebacker — a custom backdoor and loader exclusively associated with the group — alongside other Lazarus-linked tooling. The attribution is firm on the group level, though uncertainty remains about which Lazarus sub-group is conducting the operations.

Why Switch to Someone Else’s Ransomware?

The strategic logic is straightforward. As one researcher put it: “Why go to the trouble of developing your own ransomware payload when you can use a tried-and-tested threat such as Medusa or Qilin? They may have decided that the benefits outweigh the costs in terms of affiliate fees.”

For Lazarus, the advantages of this pivot include:

Plausible deniability. When a victim sees Medusa ransomware in their environment, the first assumption is criminal — not state-sponsored. Attribution becomes harder when the ransomware itself is used by dozens of affiliates worldwide.

Operational efficiency. Medusa’s infrastructure — payment portals, leak sites, negotiation channels — is already built, tested, and operational. Lazarus avoids the development and maintenance overhead of custom ransomware tooling.

Revenue generation. North Korea has long used cybercrime to fund its weapons programs, with state-sponsored cryptocurrency theft exceeding $6 billion since 2017 — including the single $1.5 billion Bybit heist in February 2025. Ransomware adds a parallel revenue stream that operates at scale.

Speed to deployment. Rather than investing months in developing, testing, and deploying custom ransomware, Lazarus operators can focus on what they do best — gaining initial access and moving laterally — then hand off the encryption and extortion to proven infrastructure.

The Attack Chain in Detail

The operational pattern observed by Symantec follows a consistent sequence:

Initial access comes through credential theft, phishing, or exploitation of exposed services — classic Lazarus tradecraft refined over a decade of operations.

Lateral movement and privilege escalation follow, with Lazarus operators moving through the victim environment to achieve domain-level control. This phase uses a mix of Lazarus-exclusive tools and common living-off-the-land techniques.

Tooling deployment includes Comebacker, the Lazarus-linked backdoor/loader that serves as the strongest attribution indicator; Blindingcan, a remote access Trojan previously associated with Lazarus operations; and ChromeStealer, designed to extract stored credentials from Google Chrome browsers.

Ransomware deployment occurs once sufficient control is achieved. Medusa encrypts systems while exfiltrating data to support double-extortion — threatening both permanent encryption and public data exposure to maximize pressure.

Ransom demands have averaged $260,000 across healthcare and nonprofit targets since November 2025, relatively modest by enterprise ransomware standards but devastating for resource-constrained organizations.

Healthcare in the Crosshairs

The target selection reveals a deliberate strategy. Analysis of the Medusa leak site shows four healthcare and nonprofit organizations in the United States listed since early November 2025, including a nonprofit in the mental health sector and an educational facility for autistic children.

These targets share characteristics that make them attractive to Lazarus:

• Low security maturity. Healthcare nonprofits typically operate with minimal IT security budgets and staff.
• High payment motivation. Patient care disruption creates urgent pressure to pay.
• Limited forensic capability. Small nonprofits rarely have the resources for prolonged incident response.
• Regulatory exposure. HIPAA breach notification requirements add reputational pressure beyond the ransom itself.

Symantec also identified a successful attack against a target in the Middle East, along with a failed attempt to breach a U.S. healthcare organization, indicating the campaign is broader than the leak site alone reveals.

Attribution Complexity: Which Lazarus Is This?

The Lazarus Group is not a single entity but a constellation of sub-groups operating under North Korea’s Reconnaissance General Bureau. Symantec noted that while the TTPs — extortion attacks against U.S. healthcare — resemble previous Stonefly (also known as Andariel or Onyx Sleet) operations, the malware tools used are not exclusive to Stonefly. The Comebacker backdoor, for example, has also been linked to the Pompilus (Diamond Sleet) sub-group.

This ambiguity may be intentional. If North Korea is deploying Medusa through multiple sub-groups, it creates operational redundancy. Disrupting one team does not stop the campaign.

Symantec also identified a separate Lazarus campaign using Qilin ransomware alongside Medusa, suggesting the group may be diversifying across multiple RaaS platforms simultaneously.

What This Means for Defenders

The convergence of nation-state capability and criminal RaaS infrastructure demands updated threat models:

Attribution assumptions must change. Medusa in your environment no longer means “criminal group.” It could mean “state-sponsored operator with nation-state resources for initial access and persistence.”

Healthcare security investment is non-negotiable. The $260,000 average ransom underestimates the true cost — regulatory fines, legal liability, and patient care disruption multiply the impact by an order of magnitude.

Hunt for Lazarus indicators alongside Medusa. Detection rules for Comebacker, Blindingcan, and ChromeStealer should be deployed alongside standard Medusa IOCs. The presence of these tools alongside Medusa is the clearest signal of a Lazarus-affiliated attack.

Credential hygiene blocks the entry point. Lazarus gains initial access through credential theft and phishing. Robust MFA, credential monitoring, and phishing-resistant authentication directly undermine the attack chain.

Assume double extortion is the default. Every Medusa deployment includes data exfiltration. Network segmentation and data loss prevention controls must be in place before the ransomware deploys, not after.

Frequently Asked Questions

Sources & Further Reading

• Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks — The Hacker News
• Lazarus Group Picks a New Poison: Medusa Ransomware — Dark Reading
• North Korean Lazarus Group Now Working With Medusa Ransomware — Security.com
• Lazarus Group Targets Healthcare Orgs with Medusa Ransomware — The Register
• Lazarus Hackers Adopt Medusa Ransomware for Extortion Campaigns — Industrial Cyber
• North Korean Lazarus Group Linked to Medusa Ransomware Attacks — Bleeping Computer