G0032 - Lazarus Group

Name: G0032 - Lazarus Group
Creator: Maltiverse
Published: 2023-03-03

Lazarus Group is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau. The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.

Author: agomez
Created: 2023-03-03 15:56:44
Last updated: 2026-02-07 18:57:08
Downloads: 350350
Hostname indicators: 46
Sample indicators: 140

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

msedgepackageinfo.com Hostname

modified 2026-10-17 08:38:09
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

visualstudiofactory.com Hostname

modified 2026-10-17 08:38:09
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

msstorageboxes.com Hostname

modified 2026-10-17 08:38:09
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

www.ne-ba.org Hostname

modified 2026-10-17 00:35:59
Lazarus Group (Maltiverse) · CVE-2017-0199 (Hybrid-Analysis) · Malicious site (Hybrid-Analysis)

glcloudservice.com Hostname

modified 2026-10-16 20:37:25
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

officeaddons.com Hostname

modified 2026-10-16 20:35:11
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

zacharryblogs.com Hostname

modified 2026-10-16 16:32:57
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

sbmsa.wiki Hostname

modified 2026-10-16 16:32:53
Malicious URL (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

94f0a183179e4f0663de341433baa4f0f1a513136ee2e67961bb4697df91bd53 Sample

modified 2026-10-16 15:28:55
Andariel (Cyber Threat Alliance)

azuredeploystore.com Hostname

modified 2026-10-16 08:38:11
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

d6cb499f204854eb75032147eaf7e22e47c86c4450b7f8d4965300de047bd1cf Sample

modified 2026-10-16 07:25:39
Andariel (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

careerpredictto.space Hostname

modified 2026-10-15 20:36:15
Lazarus (Maltiverse Threat Observatory)

9b3eaa6ed18635daede41a7530267dd96d86687f9929182f952d2eea7249c1d5 Sample

modified 2026-10-15 17:55:36
Andariel (Cyber Threat Alliance)

msstorageazure.com Hostname

modified 2026-10-15 16:40:18
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

pbxcloudeservices.com Hostname

modified 2026-10-15 16:40:17
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

azureonlinestorage.com Hostname

modified 2026-10-15 16:40:17
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

vsexec.com Hostname

modified 2026-10-15 16:39:17
Roaming Mantis (Maltiverse) · Lazarus Group (Maltiverse)

uxtramine.org Hostname

modified 2026-10-15 16:35:45
Lazarus (Maltiverse Threat Observatory)

1035b4f6205f7847774828683bc7f750ae75de1c256c7e8501e0d8733e7c7539 Sample

modified 2026-10-15 06:08:41
Andariel (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

careerpulsynk.xyz Hostname

modified 2026-10-14 20:22:34
Lazarus (Maltiverse Threat Observatory)

ceronet.work Hostname

modified 2026-10-14 20:14:07
Lazarus (Maltiverse Threat Observatory)

ceronetwork.org Hostname

modified 2026-10-14 20:14:01
Lazarus (Maltiverse Threat Observatory)

onoplanoai.ink Hostname

modified 2026-10-14 16:09:24
Lazarus (Maltiverse Threat Observatory)

916a9af897d43692fd2288ace058f7fb433492f9193e249e3624cb0c98c433f2 Sample

modified 2026-10-14 15:58:43
Andariel (Cyber Threat Alliance)

recruitptogether.xyz Hostname

modified 2026-10-14 15:31:41
Lazarus (Maltiverse Threat Observatory)

c598e40ac35c44ab94dd003212702a977f3aa52da81fbe22d2b11d96cb858c39 Sample

modified 2026-10-13 15:36:39
Andariel (Cyber Threat Alliance)

predicttogether.ink Hostname

modified 2026-10-13 13:04:04
Lazarus (Maltiverse Threat Observatory)

nxlog.tech Hostname

modified 2026-10-13 12:43:48
Lazarus (Maltiverse Threat Observatory)

domatisc.ink Hostname

modified 2026-10-13 12:33:02
Lazarus (Maltiverse Threat Observatory)

onoplainai.ink Hostname

modified 2026-10-13 11:55:18
Lazarus (Maltiverse Threat Observatory)

asteara.org Hostname

modified 2026-10-13 10:48:10
Lazarus (Maltiverse Threat Observatory)

predictcareertogether.space Hostname

modified 2026-10-13 10:42:28
Lazarus (Maltiverse Threat Observatory)

contactpulsynk.ink Hostname

modified 2026-10-13 10:10:25
Lazarus (Maltiverse Threat Observatory)

culyrax.us Hostname

modified 2026-10-13 10:05:28
Lazarus (Maltiverse Threat Observatory)

notifypulsynk.ink Hostname

modified 2026-10-13 10:04:21
Lazarus (Maltiverse Threat Observatory)

elsavora.us Hostname

modified 2026-10-13 09:58:06
Lazarus (Maltiverse Threat Observatory)

trixauvex.org Hostname

modified 2026-10-13 09:29:38
Lazarus (Maltiverse Threat Observatory)

trixauvexnet.ink Hostname

modified 2026-10-13 09:28:09
Lazarus (Maltiverse Threat Observatory)

deck.31ventures.info Hostname

modified 2026-10-12 16:37:35
Lazarus Group (Maltiverse)

f5c6cec7facbddddccb23eb2cfcf793f0a4081792769ef29ddfcf8132fbf4313 Sample

modified 2026-10-10 06:19:31
Andariel (Cyber Threat Alliance)

ec78bab171297998f7eaa797df128070eba3b629329b17130fe1861ff22ef84f Sample

modified 2026-10-10 06:10:38
Andariel (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b Sample

modified 2026-10-10 05:50:59
Roaming Mantis (Maltiverse) · Lazarus Group (Maltiverse) · Trojan.Win64.Agent (Hybrid-Analysis)

c55faa92c38ae4282ee749231af1146b65b7761f3e20f63c75780033034f3d0b Sample

modified 2026-10-08 11:10:29
Andariel (Cyber Threat Alliance)

0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e.bin Sample

modified 2026-10-04 16:43:37
Trojan.Manuscrypt (Hybrid-Analysis) · Lazarus (MalwareBazaar Abuse.ch)

2627b7c827404ee49271bfc6bb152e52cf28e35c4bef1ad256018c5c08daea21 Sample

modified 2026-09-12 00:54:31
Roaming Mantis (Maltiverse) · Lazarus Group (Maltiverse)

pbxphonenetwork.com Hostname

modified 2026-09-04 18:54:51
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

akamaitechcloudservices.com Hostname

modified 2026-09-04 18:53:53
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

7e2b38decf1f826fbb792d762d9e6a29147e9ecb44eb2ad2c4dc08e7ee01a140 Sample

modified 2026-08-26 02:47:09
Lazarus Group (Maltiverse)

pbxsources.com Hostname

modified 2026-08-25 09:46:43
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

sourceslabs.com Hostname

modified 2026-08-24 15:37:07
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

RAN_Medusa_20260411.exe Sample

modified 2026-08-07 03:03:22
Generic Malware (Hybrid-Analysis) · Medusa (MalwareBazaar Abuse.ch) · Lazarus Group (MalwarePatrol) · Medusaransomware (Triage)

akamaicontainer.com Hostname

modified 2026-08-01 21:04:47
Malicious URL (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

azureonlinecloud.com Hostname

modified 2026-08-01 21:04:47
Malicious URL (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

dunamistrd.com Hostname

modified 2026-08-01 21:04:47
Malicious URL (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

qwepoi123098.com Hostname

modified 2026-08-01 21:04:47
Malicious URL (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

3CXDesktopApp-18.12.416.msi Sample

modified 2026-07-24 00:59:18
Lazarus Group (Maltiverse) · Generic Malware (Hybrid-Analysis) · Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Triage)

scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt Sample

modified 2026-06-16 15:45:04
Lazarus Group (Maltiverse) · Generic Malware (Hybrid-Analysis)

dalbinews.co.kr Hostname

modified 2026-05-21 21:31:56
Lazarus Group (Maltiverse)

localfile~.x64.macho Sample

modified 2026-04-09 01:56:29
Generic Malware (Hybrid-Analysis) · Lazarus Group (MalwarePatrol)

02a28bc6829edef5e8a8f0cc5140056d2842588daea61247a31f9cca69061bbf Sample

modified 2026-03-27 02:24:51
Lazarus Group (Maltiverse) · Roaming Mantis (Maltiverse)

bounty-30191403276680668 Sample

modified 2026-03-10 04:30:10
Generic Malware (Hybrid-Analysis) · Lazarus Group (Maltiverse) · Kimsuky (MalwarePatrol)

Latest Indicators of Compromise in this feed

msedgepackageinfo.com Hostname

visualstudiofactory.com Hostname

msstorageboxes.com Hostname

www.ne-ba.org Hostname

glcloudservice.com Hostname

officeaddons.com Hostname

zacharryblogs.com Hostname

sbmsa.wiki Hostname

94f0a183179e4f0663de341433baa4f0f1a513136ee2e67961bb4697df91bd53 Sample

azuredeploystore.com Hostname

d6cb499f204854eb75032147eaf7e22e47c86c4450b7f8d4965300de047bd1cf Sample

careerpredictto.space Hostname

9b3eaa6ed18635daede41a7530267dd96d86687f9929182f952d2eea7249c1d5 Sample

msstorageazure.com Hostname

pbxcloudeservices.com Hostname

azureonlinestorage.com Hostname

vsexec.com Hostname

uxtramine.org Hostname

1035b4f6205f7847774828683bc7f750ae75de1c256c7e8501e0d8733e7c7539 Sample

careerpulsynk.xyz Hostname

ceronet.work Hostname

ceronetwork.org Hostname

onoplanoai.ink Hostname

916a9af897d43692fd2288ace058f7fb433492f9193e249e3624cb0c98c433f2 Sample

recruitptogether.xyz Hostname

c598e40ac35c44ab94dd003212702a977f3aa52da81fbe22d2b11d96cb858c39 Sample

predicttogether.ink Hostname

nxlog.tech Hostname

domatisc.ink Hostname

onoplainai.ink Hostname

asteara.org Hostname

predictcareertogether.space Hostname

contactpulsynk.ink Hostname

culyrax.us Hostname

notifypulsynk.ink Hostname

elsavora.us Hostname

trixauvex.org Hostname

trixauvexnet.ink Hostname

deck.31ventures.info Hostname

f5c6cec7facbddddccb23eb2cfcf793f0a4081792769ef29ddfcf8132fbf4313 Sample

ec78bab171297998f7eaa797df128070eba3b629329b17130fe1861ff22ef84f Sample

b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b Sample

c55faa92c38ae4282ee749231af1146b65b7761f3e20f63c75780033034f3d0b Sample

0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e.bin Sample

2627b7c827404ee49271bfc6bb152e52cf28e35c4bef1ad256018c5c08daea21 Sample

pbxphonenetwork.com Hostname

akamaitechcloudservices.com Hostname

7e2b38decf1f826fbb792d762d9e6a29147e9ecb44eb2ad2c4dc08e7ee01a140 Sample

pbxsources.com Hostname

sourceslabs.com Hostname

RAN_Medusa_20260411.exe Sample

akamaicontainer.com Hostname

azureonlinecloud.com Hostname

dunamistrd.com Hostname

qwepoi123098.com Hostname

3CXDesktopApp-18.12.416.msi Sample

scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt Sample

dalbinews.co.kr Hostname

localfile~.x64.macho Sample

02a28bc6829edef5e8a8f0cc5140056d2842588daea61247a31f9cca69061bbf Sample

bounty-30191403276680668 Sample

fdd4b78aa4e0914f3bcdc2632338ebbd300fdc3f05a3df85a5a3067f97627e45 Sample

f0f4423cd8d5ceafb4e4a18014ff4ed8913021d83bc2c3a973a419b9fe466c19 Sample

e24e4c949894b08a66b925b6c55f12d1b3c69adc95b79e99a31315e289d193fc Sample

df1b9ec31fa4578dee7668207064de7185798801bb032c715aa24cce7e35bcda Sample

d80daa7b30732b2b71d63a5881a254d12eb0d499a015dc4c98602caa2001d2a3 Sample

db98d087d4cdb2a82096df424f86edea8d4730543a2005f43bede9ffc6123791 Sample

cfe33c6faacc824fcb475d450d6ba19316884fad4c85f563a330a86d03ecff0c Sample

cf5e38d65bef38654080635fcb76890e3e0548626b0598bc8090b18116220389 Sample

c69acc7364da828f098394b1a6907788d4fd379ed2af7d966e86a2becea4c0ad Sample

ce4fcb97ada09a42c03c3456c5fe09d805948a95efaf365eb1cd2b4e82013990 Sample

bf27c5e2591febe90e52cd99231526a342bc423000fe87cce44ef1c3acaeeab5 Sample

b8a9533a21127ff5005352d41581c5631598704e220120b623fad16e3ec2ae51 Sample

bedada1c52e9bcceff8c6b542d74518afcce66f955ac6f1ab58aa43b3865fe9f Sample

bf05b1ace61aeebd251940b40624fe22a345300fc6a53a472357f9586e8e4e57 Sample

b42345567556a01d34daf262f95fdeb02f259271afbea93fb684b9656d14e568 Sample

ab3e3a8673ba5da40b325b160a782cf2f03547d9b489e87d9546da35a65d62d6 Sample

a957b5dd5f555be8431df3f35b707c149b83436d19cc3f8bbd867317a6f624b1 Sample

a670d8818a6efe2919c18c740ef4f3478551b28481d0a1591539be45ceca2171 Sample