Ransomware-as-a-Service (RaaS) Set's It's Sights on the Healthcare Industry
February 24th, 2026
❓What:
The North Korean-linked Lazarus Group (also tracked under aliases like Diamond Sleet or Andariel) has been observed deploying Medusa ransomware in extortion attacks against at least one organization in the Middle East and attempting, unsuccessfully, to breach a U.S. based healthcare entity.
Medusa, a ransomware-as-a-service (RaaS) strain operated by the cybercrime group Spearwing, has been used by affiliates in hundreds of attacks, but this is the first time Lazarus has been tied to it.
Spearwing has claimed responsibility for over 366 attacks to date.
⚠️Impact:
Targeting hospitals, healthcare nonprofits, and other high-impact services escalates risk to critical infrastructure and patient safety.
Medusa attacks typically encrypt systems and demand ransoms (reportedly averaging ~$260,000), and even failed intrusions drain defensive resources and can disrupt operations.
The use of commodity and custom tools (like Comebacker, Blindingcan, and credential stealers) increases attack sophistication and persistence.
Lazarus’ shift to rent-a-ransomware demonstrates that nation-state actors are leveraging criminal ecosystems to fund and scale financially motivated operations.
💡Recommendations:
Elevate Ransomware Defenses for Healthcare & Critical Sectors: Harden email gateways, remote access points, and endpoint protection; ensure regular backups are offline and tested.
Expand Threat Hunting and Detection: Deploy or enhance anomaly detection for ransomware TTP's, unusual process spawning, lateral movement behaviors, and credential dumping tools.
Strengthen Segmentation and Least-Privilege Access: Proper network segmentation and strict access controls reduce the blast radius of ransomware and limit lateral travel.
Incident Response Preparedness: Exercise ransomware playbooks with tabletop exercises, update recovery procedures, and secure communications channels for crisis response.
Threat Intelligence Sharing: Exchange IOC's and attacker behaviors with ISAC's and trusted partners to accelerate detection of emerging variants like Medusa in the wild.
Read the full article HERE