Lazarus Group Targets Healthcare with Medusa Ransomware: Analysis and Detection

In a concerning escalation of cyber warfare tactics, the notorious North Korea-linked Lazarus Group (also tracked as Diamond Sleet or Pompilus) has been observed utilizing the Medusa ransomware variant in attacks against critical infrastructure. Recent intelligence from the Broadcom threat intelligence unit (Symantec and Carbon Black) highlights two significant campaigns: a successful strike on an undisclosed entity in the Middle East and an attempted intrusion into the U.S. healthcare sector.

For a managed security provider like Security Arsenal, this represents a critical pivot. State-sponsored actors are increasingly adopting "big game hunting" tactics traditionally reserved for financially motivated cybercriminals. By leveraging commodity ransomware like Medusa, these groups can blend in with everyday noise while maintaining the sophisticated operational security of a nation-state.

The Evolution of Lazarus TTPs

Historically, Lazarus has been associated with espionage, cryptocurrency heists, and destructive wiper malware. Their deployment of Medusa signals a strategic shift toward "double extortion." Rather than just encrypting data for a payday, they are likely stealing sensitive patient data or intellectual property to exert additional pressure on victims—a tactic that creates a compliance nightmare for healthcare institutions governed by HIPAA.

Attack Vector Analysis

While the initial access vector in the Middle East incident is still being analyzed, Lazarus Group historically relies on:

Phishing with Malicious Payloads: Social engineering campaigns delivering weaponized documents.
Supply Chain Compromise: Leveraging trusted software relationships (as seen in previous 3CX attacks).
Exploitation of Public-Facing Vulnerabilities: Scanning for unpatched services in edge infrastructure.

Once inside the network, the deployment of Medusa involves a distinct set of behaviors. Medusa typically utilizes tools like rclone for large-scale data exfiltration before the encryption phase begins. They often employ PowerShell scripts to disable security controls and clear logs to evade detection.

Detection and Threat Hunting

Detecting Medusa requires looking beyond the encryption event. By the time ransom notes appear, it is too late. Security teams must hunt for the precursors—specifically the exfiltration tools and the process execution patterns associated with this strain.

KQL Queries for Microsoft Sentinel/Defender

The following KQL query can be used to hunt for the use of rclone, a common tool used by Medusa operators for data theft, as well as suspicious PowerShell execution patterns often used by Lazarus for defense evasion.

Script / Code

// Hunt for Medusa indicators and Rclone exfiltration
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rclone.exe", "rclone") or 
   ProcessCommandLine has_any("config", "sync", "copy") and ProcessCommandLine has "http"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| extend Tactic = "Exfiltration"
| union (
    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any("-enc", "-encodedcommand", "bypass", "hidden")
    | where ProcessCommandLine has @"System.Management.Automation"
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend Tactic = "Defense Evasion"
)
| order by Timestamp desc

PowerShell Hunting Script

You can deploy the following PowerShell script across endpoints to scan for the presence of known Medusa ransomware note extensions or the presence of the rclone binary in common user directories.