criticalAPT

When Nation-States Become Ransomware Affiliates: Lazarus Group Deploys Medusa via a Custom IME-Based Loader

PublishedMarch 17, 2026

Threat Actors:APT38APT45ProfileAssessmentTimeline

aptdll-sideloadingc2ransomwaresupply-chain

Published: 2026-03-09 | Author: BGI | Classification: TLP:CLEAR

TL;DR

Two malware samples recovered from the same Hungarian incident -- a Medusa ransomware binary (gaze.exe) and a custom DLL sideloading loader (TSMSISrv.dll) -- provide concrete evidence that the Lazarus Group (DPRK) is operating as an affiliate of the Medusa ransomware-as-a-service program. The loader, built on the Windows 8 IME SDK with custom AES tables and dual TLS anti-analysis callbacks, was compiled seven months before the ransomware -- mapping a patient intrusion chain where Lazarus established persistent SYSTEM-level access first and deployed extortion payloads second. The two samples were compiled with different Visual Studio versions (VS2019 vs VS2022) on different architectures (x86 vs x64), strongly suggesting the ransomware came from the Medusa builder toolkit while the loader was developed in-house. This is not Lazarus building their own ransomware. This is Lazarus buying into someone else's extortion platform. North Korea's cyber operations have entered the affiliate economy.

What We Found

Two samples from a single intrusion, submitted by the same Hungarian researcher (smica83) within two weeks of each other
A fully functional Medusa ransomware binary with XOR-encoded configuration (key 0x2E) containing four Tor .onion C2 addresses, a victim-specific negotiation endpoint, and kill lists targeting 50+ enterprise security and backup services
A sophisticated DLL sideloading loader built on top of a legitimate Windows 8 IME SDK sample, masquerading as a Terminal Services component, executing as SYSTEM via the SessionEnv service
A 7-month gap between loader compilation (March 2025) and ransomware compilation (October 2025) -- consistent with Lazarus's documented patience in high-value intrusions
HIGH confidence Lazarus attribution via Kaspersky (Trojan.Win64.Lazarus.ey) and ReversingLabs (Win64.Trojan.Lazarus) detections, corroborated by six independent TTP matches
Evidence of a RaaS affiliate model: the PDB path G:\Medusa\Release\gaze.pdb and the VS2019/x86 build profile are consistent with a Medusa builder output, not in-house development

Why This Matters: The APT-Ransomware Convergence

Lazarus Group has historically built its own ransomware -- WannaCry (2017), Maui (2022), H0lyGh0st (2022). In every prior case, DPRK operators controlled the entire stack: they wrote the code, ran the infrastructure, and collected the payments.

This investigation documents something different. The PDB path G:\Medusa\Release\gaze.pdb is not a Lazarus creation -- it is the output of the Medusa builder toolkit, a RaaS platform attributed to cybercrime group Spearwing. The ransomware carries builder hallmarks: x86/32-bit compilation, VS2019, retained PDB, BCrypt API. Meanwhile, the loader is unmistakably bespoke Lazarus: VS2022/x64, stripped PDB, custom AES bypassing CryptoAPI, dual TLS callbacks, COM hijacking, IME SDK camouflage.

Lazarus brought their own access tools to someone else's ransomware operation. They are operating as a Medusa RaaS affiliate. The implications:

Revenue velocity over control. The Medusa builder produces a binary in minutes vs. months of in-house development.
Attribution camouflage. Initial triage sees "Medusa" -- not "DPRK APT." Only deeper loader analysis reveals Lazarus.
Operational cover. DPRK blends into the noise of dozens of Medusa affiliates.
Sanctions evasion. Payments flow through Medusa infrastructure, adding separation from DPRK wallets.

This is the convergence that threat intelligence analysts have warned about: nation-state TTPs meeting the cybercrime-as-a-service economy.

The Attack Chain

PHASE 1: ACCESS & PERSISTENCE (March 2025)
=========================================================================

  Initial Access           DLL Sideloading          Persistence
  (Unknown vector)         TSMSISrv.dll             COM Hijacking
       |                        |                        |
       |  Spearphish or         |  Replaces Terminal     |  DllRegisterServer
       |  supply chain          |  Services MSI DLL      |  writes CLSID
       |                        |                        |
       +-------> svchost.exe    +-------> Runs as        +-------> Survives
                 loads DLL at       SYSTEM via                reboots silently
                 boot               SessionEnv

  Anti-Analysis            Custom AES Crypto         C2 Beacon
  Dual TLS Callbacks       S-box at 0x72000          (Encrypted)
       |                        |                        |
       +-------> Check PEB      +-------> Decrypt C2     +-------> Stage
                 before DllMain      config & comms           ransomware


PHASE 2: EXTORTION (October 2025 -- 7 months later)
=========================================================================

  gaze.exe Deployed        Kill 50+ Services         RSA+AES Encryption
       |                        |                        |
       +-------> XOR-decode     +-------> vssadmin       +-------> 10,129+ files
                 config (0x2E)       Delete Shadows           encrypted, keys
                 extract C2          /all /quiet              RSA-wrapped

  !!!READ_ME_MEDUSA        Tor Negotiation           Payment
       |                        |                        |
       +-------> Drop in        +-------> Victim chat    +-------> Revenue split
                 every dir           /00b4f860f...            with Medusa ops

The timestamps tell the story: loader built 2025-03-20, ransomware built 2025-10-17. Seven months of dwell time -- consistent with Lazarus's documented patience in high-value intrusions.

The Loader: TSMSISrv.dll

Property	Value
SHA-256	`aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7`
MD5	`447557d5236f1b97be0314b317ca9fff`
SHA-1	`28978e987bc59e75ca22562924eab93355cf679e`
Size	828,416 bytes (809 KB)
Architecture	x64 (64-bit)
Compiler	MSVC (VS2022 v17.3+, linker 14.33)
Compiled	2025-03-20 18:42:02 UTC
PDB Path	None (stripped)
Entropy	5.8867
Imphash	`655221b6bcad7b5b0b9766142cbc257a`
Detection	Kaspersky `Trojan.Win64.Lazarus.ey`, ReversingLabs `Win64.Trojan.Lazarus`

The Sideloading Vector

TSMSISrv.dll is the Terminal Services MSI Server component -- a legitimate Windows DLL loaded by svchost.exe via the SessionEnv service (Terminal Services Session Configuration). SessionEnv starts automatically at boot and runs as SYSTEM. By replacing this DLL, the operator gets persistent, privileged execution via a trusted process chain (services.exe -> svchost.exe -> TSMSISrv.dll) -- no new service creation events, no registry run keys, no startup folder entries. The SessionEnv service runs on every Windows Server with Remote Desktop Services, which means the target surface is enterprise infrastructure.

IME SDK Camouflage

The binary is built on top of the Windows 8 IME SDK sample code -- specifically the "SampleIME" Simplified Chinese QuanPin Input Method. The version information is copied verbatim:

CompanyName:      MSFT
FileDescription:  The Sample code of Windows 8 IME
FileVersion:      1.0.0.1
InternalName:     SampleIM.dll
OriginalFilename: SampleIM.dll
ProductName:      SampleIME

RTTI class names (CSampleIME, CBaseDictionaryEngine, CCompositionProcessorEngine, CKeyStateComposing, CTipCandidateList) confirm the IME codebase is functional, not just metadata decoration. The ~800 KB of legitimate code dilutes static analysis signatures, and the IME's COM registration mechanism provides a natural persistence vehicle. Using legitimate SDK samples as trojan shells is a documented Lazarus technique.

Export Table Analysis

Export	Ordinal	Function
`DllCanUnloadNow`	1	Real -- checks COM reference count, gates DLL unload
`DllGetClassObject`	2	Primary payload entry -- COM class factory instantiation triggers malicious code path
`DllRegisterServer`	3	Persistence installer -- calls three internal functions to establish COM hijacking
`DllUnregisterServer`	4	Cleanup chain -- reverses COM registration
`OnSessionChange`	5	Stub -- single `ret` instruction, returns immediately
`Refresh`	6	Stub -- single `ret` instruction
`StartComponent`	7	Stub -- single `ret` instruction
`StopComponent`	8	Initialization code with conditional logic

The stub exports exist solely to satisfy svchost.exe's expected export table. The real functionality lives in DllGetClassObject (payload execution when COM clients request the hijacked CLSID) and DllRegisterServer (persistence installation via CLSID\{...}\InProcServer32 registry entries).

Dual TLS Anti-Analysis Callbacks

Two Thread Local Storage (TLS) callbacks execute before DllMain -- a technique that defeats debuggers whose entry-point breakpoints fire too late:

Callback	RVA	Behavior
Callback 0	`0x20a70`	Accesses TEB/PEB structures, checks flags consistent with debugger detection
Callback 1	`0x208e0`	Complex initialization sequence, conditional operations based on process state

TLS callbacks are a documented Lazarus evasion technique observed in both SIGNBT and LightlessCan. An analyst who sets a breakpoint on DllMain will miss these callbacks entirely -- the anti-analysis checks complete before the debugger gains control.

Custom AES Implementation

At file offset 0x72000-0x74000 (8,192 bytes), the binary contains a complete custom AES implementation -- forward/inverse S-boxes, round constants, and pre-computed MixColumns T-tables. This bypasses Windows CryptoAPI and BCrypt entirely, defeating security products that hook those APIs to inspect encrypted traffic. Rolling custom cryptography is a documented Lazarus preference observed in SIGNBT and COPPERHEDGE -- a strong attribution indicator.

COM Hijacking Persistence

DllRegisterServer writes HKCR\CLSID\{<hijacked-CLSID>}\InProcServer32 entries pointing to the malicious DLL with ThreadingModel set to Apartment. Any COM client requesting the hijacked CLSID loads the malware -- invisible to most monitoring because COM instantiation is a normal, high-frequency Windows operation.

The Ransomware: gaze.exe

Property	Value
SHA-256	`15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10`
MD5	`60aaafce354ae5e0b8115729464a8b24`
SHA-1	`53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf`
Size	638,976 bytes (624 KB)
Architecture	x86 (32-bit)
Compiler	MSVC (VS2019 v16.7+, linker 14.27)
Compiled	2025-10-17 13:48:31 UTC
PDB Path	`G:\Medusa\Release\gaze.pdb`
Entropy	6.6986
Imphash	`82a8292007e682f1a127ba8dcebfae96`
Detection	ClamAV `Win.Ransomware.Medusa-10025438-0`, Kaspersky `Trojan-Ransom.Win64.Agent.sb`

XOR-Encoded Configuration

The entire operational configuration lives at file offset 0x87600-0x89C00, XOR-encoded with the single-byte key 0x2E. Decoding reveals the complete Medusa operational package:

Four Tor .onion addresses:

Address	Purpose
`xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd[.]onion`	Medusa leak blog (primary)
`7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id[.]onion`	Leak blog mirror
`s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad[.]onion`	Leak blog mirror
`uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd[.]onion/00b4f860f1798b62b3531f1b4e8bb6e0`	Victim-specific negotiation chat

The victim-specific endpoint embeds 00b4f860f1798b62b3531f1b4e8bb6e0, confirming this build was generated for a specific target. The config also contains an RSA-2048 public key (PEM format), a Tox Chat ID for alternative negotiation, a 50+ service kill list, shadow copy deletion commands, a network drive encryption flag, and PowerShell execution templates.

Encryption Scheme

Standard Medusa hybrid encryption via BCrypt API: BCryptImportKeyPair imports the RSA-2048 public key, BCryptGenerateSymmetricKey creates a per-file AES key, BCryptEncrypt encrypts file contents, and the AES key is RSA-wrapped and appended. Without the operator's private key, decryption is infeasible. Unchanged from documented Medusa variants -- used as-is from the builder.

Service and Process Kill Lists

Before encryption begins, the ransomware systematically dismantles the victim's defensive and backup infrastructure:

SECURITY PRODUCTS KILLED:
  Sophos MCS Client          Sophos File Scanner       Sophos AutoUpdate
  Sophos Safestore           Sophos Health             Sophos Web Control
  McAfeeFramework            McAfeeEngineService       EPSecurityService
  SepMasterService           Symantec System           TrueKeyService

BACKUP SERVICES KILLED:
  VeeamCatalogSvc            VeeamHvIntegration        VeeamTransportSvc
  VeeamEnterprise            Veeam Backup Catalog      BackupExecVSSPro
  BackupExecJobEngine        BackupExecManage          BackupExecDevice
  BackupExecRPCService       BackupExecAgent           Acronis VSS Provider

DATABASE SERVICES KILLED:
  SQLAgent$ECWDB2            MSSQLFDLauncher           MSSQL$VEEAMSQL20
  MSSQL$SHAREPOINT           MSSQL$SQLEXPRESS          MSSQL$PRACTTICEBG
  MSSQLServerADHelper        MSSQLServerOLAPS          OracleClientCache

Sandbox analysis (Triage, CAPE, ANY.RUN) confirmed 10,129+ files encrypted, Active Setup persistence, browser/Credential Manager theft, network share encryption, and ping localhost as an anti-sandbox timer.

The Intrusion Timeline

Date	Event	Significance
2025-03-20	TSMSISrv.dll compiled (VS2022, x64)	Loader deployed -- persistent SYSTEM access established
2025-06-30	TSMSISrv.dll first observed by ReversingLabs	AV detection begins, but loader likely already active in victim network
2025-08-13	TSMSISrv.dll first observed by Kaspersky	Second vendor detection -- still 2 months before ransomware
2025-10-17	gaze.exe compiled (VS2019, x86)	Ransomware built for this specific target via Medusa builder
2025-10-19	gaze.exe first observed by Kaspersky, ANY.RUN	Ransomware submitted to sandboxes -- likely post-incident
2026-02-12	TSMSISrv.dll submitted to MalwareBazaar by smica83	Incident responder finds loader during forensic analysis
2026-02-26	gaze.exe submitted to MalwareBazaar by smica83	Same responder finds ransomware -- confirms single intrusion

During those seven months, the operator maintained SYSTEM-level access via SessionEnv, encrypted C2 via custom AES, and COM-based persistence that blended with normal Windows operations. The 14-day gap between MalwareBazaar submissions suggests the incident responder found the loader first during forensic triage, then discovered the ransomware during deeper investigation.

Two Build Environments, One Campaign

Attribute	gaze.exe (Ransomware)	TSMSISrv.dll (Loader)
Architecture	x86 (32-bit)	x64 (64-bit)
Compiler	VS2019 v16.7+ (linker 14.27)	VS2022 v17.3+ (linker 14.33)
Compiled	2025-10-17	2025-03-20
PDB	Retained: `G:\Medusa\Release\gaze.pdb`	Stripped
Entropy	6.70 (higher -- denser code/data)	5.89 (lower -- IME padding)
Cryptography	BCrypt API (Windows native)	Custom AES (S-box tables)
Code signing	None	None
Rich header	Present (VS2019 build artifacts)	Present (VS2022 build artifacts)
OPSEC	Sloppy (PDB path, build config exposed)	Professional (stripped symbols, custom crypto)

The divergence in OPSEC discipline is telling. The ransomware -- retained PDB, standard APIs, old toolchain -- is consistent with automated builder output. The loader -- stripped symbols, custom crypto, current compiler -- is purpose-built by an experienced developer. This is exactly the RaaS affiliate model: the operator brings their own access tools, and the ransomware comes from the service provider.

Attribution

Confidence: HIGH -- Lazarus Group (DPRK), likely the Andariel (APT45) or BlueNoroff sub-group.

Evidence Chain

#	Evidence	Weight
1	Kaspersky detection: `Trojan.Win64.Lazarus.ey` -- Kaspersky's Lazarus-specific detection family, applied after manual analysis	HIGH
2	ReversingLabs detection: `Win64.Trojan.Lazarus` -- independent vendor corroboration	HIGH
3	DLL sideloading via Windows service: SessionEnv service hijacking is consistent with SIGNBT, LightlessCan, and COPPERHEDGE deployment patterns	MEDIUM
4	Custom AES implementation: Bypassing Windows CryptoAPI with embedded S-box tables is a documented Lazarus hallmark across multiple tool families	MEDIUM
5	IME SDK code base: Using legitimate SDK samples as trojan shells is a documented Lazarus technique	MEDIUM
6	Dual TLS callback anti-analysis: Observed in SIGNBT and LightlessCan -- part of the standard Lazarus evasion toolkit	MEDIUM
7	7-month dwell time: March-to-October gap matches the patient intrusion methodology documented in Lazarus campaigns against cryptocurrency exchanges and defense contractors	LOW (behavioral)
8	Reporter history: smica83 has a track record of APT sample submissions, including Korean-language Lazarus `.scr` files	SUPPORTING

Why Not Another Actor?

Any single indicator could be coincidental. But the specific combination of IME SDK camouflage + custom AES S-box tables + dual TLS callbacks + SessionEnv hijacking -- matched against Kaspersky and ReversingLabs Lazarus-specific signatures based on code-level analysis -- produces HIGH confidence. No other known threat group uses this exact technique combination.

OPSEC Failures

PDB path (G:\Medusa\Release\gaze.pdb): Reveals project name, build config, and build machine drive letter
Compilation timestamps: Plausible, non-stomped timestamps correlate with known activity windows
Rich headers: Build environment fingerprints retained in both samples
Version info strings: Unmodified Windows 8 IME SDK strings enable clustering
Same reporter: Both samples from one researcher within two weeks -- confirms single intrusion

MITRE ATT&CK Mapping

Tactic	Technique	ID	Implementation
Execution	Shared Modules	T1129	COM DLL loading via `DllGetClassObject`
Execution	PowerShell	T1059.001	`powershell -executionpolicy bypass -File %s`
Persistence	DLL Side-Loading	T1574.002	TSMSISrv.dll replacing Terminal Services component
Persistence	COM Hijacking	T1546.015	CLSID registration via `DllRegisterServer`
Persistence	Active Setup	T1547.014	Boot/Logon Autostart registry keys (ransomware)
Defense Evasion	Masquerading	T1036.005	TSMSISrv.dll masquerades as legitimate Windows system DLL
Defense Evasion	Obfuscated Files	T1027.002	XOR encoding (key `0x2E`) of ransomware config block
Defense Evasion	Debugger Evasion	T1622	Dual TLS callbacks execute before `DllMain`
Defense Evasion	Impair Defenses	T1562.001	Kills 50+ security services before encryption
Credential Access	Credentials from Password Stores	T1555	Browser and Windows Credential Manager theft
Discovery	System Information Discovery	T1082	`GetNativeSystemInfo`, `GetSystemFirmwareTable`
Discovery	Network Share Discovery	T1135	`GetLogicalDriveStringsW`, mapped drive enumeration
Impact	Data Encrypted for Impact	T1486	RSA+AES hybrid file encryption (10,129+ files)
Impact	Inhibit System Recovery	T1490	`vssadmin Delete Shadows /all /quiet`
Impact	Service Stop	T1489	`net stop`, `taskkill` against backup/security services

Indicators of Compromise

File Indicators -- gaze.exe (Medusa Ransomware)

Type	Value
SHA-256	`15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10`
MD5	`60aaafce354ae5e0b8115729464a8b24`
SHA-1	`53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf`
Imphash	`82a8292007e682f1a127ba8dcebfae96`
Rich Hash	`c8040dd3ff2f4afd042efd4ebe1a43c6`
SSDEEP	`12288:hy+6mXiDDQaBC9WSLe8aHDlglIdLnEAox6Kt7p733WE+jDWFt+Y+ELc2OTWvsIUE:41h5n0SleSPF1i9gs/GS6eRMUsWWPs8l`

File Indicators -- TSMSISrv.dll (Lazarus Loader)

Type	Value
SHA-256	`aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7`
MD5	`447557d5236f1b97be0314b317ca9fff`
SHA-1	`28978e987bc59e75ca22562924eab93355cf679e`
Imphash	`655221b6bcad7b5b0b9766142cbc257a`
Rich Hash	`3be2401da21dfed104c9aa52bb620344`
SSDEEP	`12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z`

Behavioral Indicators

PDB Path:             G:\Medusa\Release\gaze.pdb
Ransom Note:          !!!READ_ME_MEDUSA
XOR Config Key:       0x2E
Config Offset:        0x87600-0x89C00
DLL Target:           TSMSISrv.dll
Service Target:       SessionEnv (Terminal Services Session Configuration)
Original Filename:    SampleIM.dll
Version String:       The Sample code of Windows 8 IME
COM Registration:     CLSID\{...}\InProcServer32 (ThreadingModel: Apartment)
AES S-box Offset:     0x72000-0x74000 (8,192 bytes)
TLS Callback 0 RVA:   0x20a70
TLS Callback 1 RVA:   0x208e0
Victim ID:            00b4f860f1798b62b3531f1b4e8bb6e0
Tox Chat ID:          AEA72DFCF492037A6D15755A74645C7D8E674E342BACA9F9070A3FB74117EC3143FD6E29BEAC

Network Indicators (Defanged)

hxxp://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd[.]onion/
hxxp://7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id[.]onion/
hxxp://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad[.]onion/
hxxp://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd[.]onion/00b4f860f1798b62b3531f1b4e8bb6e0
hxxps://utox[.]org/uTox_win64.exe

Commands Executed

vssadmin Delete Shadows /all /quiet
vssadmin resize shadowstorage /for=%s /on=%s /maxsize=401MB
taskkill /F /IM [process]
net stop "%s" /y
powershell -executionpolicy bypass -File %s
powershell -Command "& {%s}"

Detection and Hunting

YARA Rules

rule Lazarus_Medusa_Gaze_Ransomware {
    meta:
        author = "Breakglass Intelligence"
        date = "2026-03-09"
        description = "Detects Lazarus-deployed Medusa ransomware (gaze.exe) via PDB path, XOR config, and BCrypt encryption imports"
        hash = "15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10"
        tlp = "TLP:CLEAR"
        severity = "CRITICAL"
        reference = "https://intel.breakglass.tech"
    strings:
        $pdb = "G:\\Medusa\\Release\\gaze.pdb" ascii
        $ransom_note = "!!!READ_ME_MEDUSA" ascii wide
        $shadow1 = "vssadmin Delete Shadows" ascii wide nocase
        $shadow2 = "vssadmin resize shadowstorage" ascii wide nocase
        $bcrypt1 = "BCryptImportKeyPair" ascii
        $bcrypt2 = "BCryptGenerateSymmetricKey" ascii
        $bcrypt3 = "BCryptEncrypt" ascii
        $svc1 = "Sophos" ascii wide
        $svc2 = "Veeam" ascii wide
        $svc3 = "McAfee" ascii wide
        $svc4 = "BackupExec" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($pdb or $ransom_note) and
        1 of ($shadow*) and
        2 of ($bcrypt*) and
        2 of ($svc*)
}

rule Lazarus_TSMSISrv_IME_Loader {
    meta:
        author = "Breakglass Intelligence"
        date = "2026-03-09"
        description = "Detects Lazarus IME SDK-based DLL sideloading loader via IME version strings, expected exports, and RTTI class names"
        hash = "aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7"
        tlp = "TLP:CLEAR"
        severity = "HIGH"
        reference = "https://intel.breakglass.tech"
    strings:
        $ime1 = "SampleIME" ascii wide
        $ime2 = "The Sample code of Windows 8 IME" ascii wide
        $ime3 = "SampleIM.dll" ascii wide
        $exp1 = "OnSessionChange" ascii
        $exp2 = "StartComponent" ascii
        $exp3 = "StopComponent" ascii
        $exp4 = "DllRegisterServer" ascii
        $rtti1 = "CSampleIME" ascii
        $rtti2 = "CCompositionProcessorEngine" ascii
        $msft = "MSFT" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint16(0x18) != 0x0040 and  // Not a .NET assembly
        2 of ($ime*) and
        3 of ($exp*) and
        1 of ($rtti*) and
        filesize > 500KB and filesize < 2MB
}

rule Lazarus_Medusa_Campaign_XOR_Config {
    meta:
        author = "Breakglass Intelligence"
        date = "2026-03-09"
        description = "Detects XOR-encoded Medusa configuration block with known Tor onion patterns and campaign identifiers"
        tlp = "TLP:CLEAR"
        severity = "HIGH"
        reference = "https://intel.breakglass.tech"
    strings:
        $onion1_xor = { 56 42 5A 4E 66 4A 44 5B }  // "xfv4jzck" XOR 0x2E
        $tox_marker = "AEA72DFCF492037A6D15755A74645C7D" ascii
        $victim_id = "00b4f860f1798b62b3531f1b4e8bb6e0" ascii
    condition:
        uint16(0) == 0x5A4D and
        any of them
}

Suricata Rules

# Medusa Tor negotiation endpoint pattern (victim-specific hash in URI)
alert http any any -> any any ( \
    msg:"BGI - Lazarus Medusa Tor Negotiation Endpoint"; \
    content:".onion/"; http_uri; \
    content:"00b4f860f1798b62b3531f1b4e8bb6e0"; http_uri; \
    reference:url,intel.breakglass.tech; \
    classtype:trojan-activity; \
    sid:9000001; rev:1; \
)

# Medusa ransom note drop detection over SMB
alert smb any any -> any any ( \
    msg:"BGI - Lazarus Medusa Ransom Note Drop"; \
    content:"!!!READ_ME_MEDUSA"; \
    reference:url,intel.breakglass.tech; \
    classtype:trojan-activity; \
    sid:9000002; rev:1; \
)

# Bulk service termination pattern (vssadmin + shadow copy deletion)
alert any any any -> any any ( \
    msg:"BGI - Medusa Shadow Copy Deletion"; \
    content:"vssadmin"; content:"Delete Shadows"; content:"/all"; content:"/quiet"; \
    reference:url,intel.breakglass.tech; \
    classtype:trojan-activity; \
    sid:9000003; rev:1; \
)

Hunting Queries

SessionEnv DLL Sideloading (KQL): Hunt for TSMSISrv.dll outside C:\Windows\System32:

DeviceFileEvents | where FileName =~ "TSMSISrv.dll"
| where FolderPath !startswith "C:\\Windows\\System32"

COM Registration Anomalies (KQL): Non-standard InProcServer32 paths:

DeviceRegistryEvents | where RegistryKey has "InProcServer32"
| where RegistryValueData !startswith "C:\\Windows\\" and RegistryValueData !startswith "C:\\Program Files"

Imphash Hunting (Splunk):

index=endpoint sourcetype=sysmon EventCode=7
(Imphash="82a8292007e682f1a127ba8dcebfae96" OR Imphash="655221b6bcad7b5b0b9766142cbc257a")

Implications for Defenders

When a nation-state APT operates as a ransomware affiliate, the defender's playbook needs to change:

Triage assumptions fail. If the loader is not found, the incident is classified as "Medusa cybercrime" -- not "DPRK APT intrusion" -- with different urgency, scope, and escalation.

Dwell time is longer. Cybercriminal affiliates operate on days-to-weeks. Lazarus operates on months. A 7-month dwell means the attacker mapped the entire network and likely exfiltrated data before encryption.

Ransomware may be secondary. DPRK historically prioritizes intelligence collection and cryptocurrency theft. The encryption event may follow months of espionage. Scope IR accordingly.

Payment funds a sanctioned regime. Under US EO 13722 and OFAC guidance, facilitating payments benefiting DPRK may violate sanctions. Organizations paying a Medusa ransom without knowing Lazarus is the affiliate face sanctions liability.

Recommended Actions

Immediate (24-48 hours):

Block all IOCs listed above at perimeter firewalls, DNS sinkholes, and endpoint detection tools
Hunt for TSMSISrv.dll in non-standard file paths (anything outside C:\Windows\System32\)
Audit SessionEnv service DLL load paths across the environment
Check for rogue COM registrations pointing to unexpected DLL paths

Short-term (1-2 weeks):

Deploy YARA and Suricata rules above to endpoint and network sensors
Run KQL/Splunk hunting queries against historical telemetry
Brief IR teams on the Lazarus-as-affiliate model and adjusted triage procedures

Medium-term (1-3 months):

Harden DLL sideloading surfaces across SYSTEM-level services
Monitor non-standard InProcServer32 COM registrations
Air-gap backup infrastructure; update ransomware playbooks to include APT attribution steps

Conclusion

Two different toolchains, two different OPSEC standards, one intrusion chain. The loader is Lazarus. The ransomware is Medusa. Together, they represent a strategic shift: DPRK has chosen to operate as a RaaS affiliate rather than build its own tooling -- gaining faster revenue, better attribution cover, and sanctions evasion through intermediary infrastructure.

For defenders, ransomware triage can no longer stop at identifying the family. The access tools behind the ransomware may tell a very different story -- one with implications for attribution, scope, dwell time, and sanctions compliance. Look deeper. The operator behind the affiliate badge may be a nation-state.

Published 2026-03-09 | Breakglass Intelligence 2 MalwareBazaar samples analyzed. Dual-tool Lazarus intrusion chain mapped. Medusa RaaS affiliate model confirmed. Samples sourced from MalwareBazaar (reporter: smica83, Hungary). Classification: TLP:CLEAR. IOCs are provided for defensive use. Handle responsibly.