Symantec and Carbon Black report that North Korean state-backed Lazarus activity is using Medusa ransomware, with evidence from an attack on a Middle East target and an unsuccessful intrusion against a U.S. healthcare organization. The activity fits a broader North Korean ransomware pattern previously linked to Maui, Play, and Stonefly/Andariel, although the excerpt says the specific Lazarus subgroup behind the Medusa activity remains unclear. The toolset includes Medusa ransomware, Lazarus-associated Comebacker and Blindingcan, credential and browser theft tools such as Mimikatz, ChromeStealer, and Infohook, plus RP_Proxy and multiple loaders. Listed infrastructure includes several IP addresses and domains such as human-check[.]com, trustpdfs[.]com, and zypras[.]com, underscoring the need to validate both ransomware and intrusion tooling against healthcare and enterprise telemetry.