[THREAT INTEL]HIGH

Lazarus Group Deploys New Ransomware Variant Targeting Healthcare

DPRK-linked threat actor pivots to healthcare sector with custom loader and encrypted C2 channels.

T. Nakamura· APT Analyst

Saturday, August 22, 2026

7 min read

HIGH SEVERITY — Review your environment and apply mitigations as soon as possible.

The Lazarus Group, a North Korean state-sponsored threat actor, has been observed deploying a new ransomware variant — dubbed 'MedLock' — against healthcare organizations across the US and EU.

The campaign uses spear-phishing emails targeting medical billing staff, followed by a custom loader that evades EDR solutions before deploying the ransomware payload.

#APT #Ransomware #Healthcare #DPRK

// RELATED THREAT INTEL

[THREAT INTEL]HIGH

APT-41 Campaign Targets Financial Sector Infrastructure

Chinese state-sponsored group APT-41 has launched a new campaign targeting SWIFT infrastructure and trading platforms.

J. Alvarez·10 min read

BACK TO RESEARCH SUBMIT YOUR RESEARCH →

Lazarus Group Deploys New Ransomware Variant Targeting Healthcare

Building a Home SOC: From Zero to Threat Detection in 48 Hours

Anatomy of a Supply Chain Attack: npm Package Poisoning

Cisco IOS XE Critical Flaw — CVE-2026-21044 Active Exploitation

Lazarus Group Deploys New Ransomware Variant Targeting Healthcare

Nuclei Template Pack: 200+ New Detection Templates for 2026 CVEs

NIST Finalizes Post-Quantum Cryptography Standards: What You Need to Know

New Evasion Technique Bypasses Major EDR Solutions

APT-41 Campaign Targets Financial Sector Infrastructure