Lazarus Group

First seen

2009-01-01 00:00:00

Origin

KP

Primary motivation

espionage

Sophistication

advanced

Resource level

government

Actor type

Espionage, Sabotage

Related IoCs

211 (185 malicious)

Last IoC activity

2026-10-17 00:35:59

Profile updated

2026-07-07 12:34:03

Targeted industries: defense-and-aerospace financial-services government-and-public-sector media-and-entertainment technology-and-telecommunications

Targeted regions: country_code:us country_code:kr country_code:jp country_code:in country_code:vn

Context

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.

Recent IoC activity

186 malicious indicators in Maltiverse are attributed to Lazarus Group (G0032). The 20 most recently updated:

Detection coverage

• 32 YARA rules
• 968 Sigma rules

Malware & tools used

• Windows Command Shell (attack-pattern)
• Spearphishing Attachment (attack-pattern)
• Indirect Command Execution (attack-pattern)
• Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
• Protocol or Service Impersonation (attack-pattern)
• Server (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Mshta (attack-pattern)
• Application Window Discovery (attack-pattern)
• Malware (attack-pattern)
• Create Process with Token (attack-pattern)
• SSH (attack-pattern)
• Account Manipulation (attack-pattern)
• Hidden Files and Directories (attack-pattern)
• Data Destruction (attack-pattern)
• Gather Victim Org Information (attack-pattern)
• Native API (attack-pattern)
• Valid Accounts (attack-pattern)
• Embedded Payloads (attack-pattern)
• Query Registry (attack-pattern)
• External Proxy (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Multi-Stage Channels (attack-pattern)
• Network Service Discovery (attack-pattern)
• Data from Local System (attack-pattern)

Related threat objects

• APT37 (threat-actor)
• Operation Sharpshooter (threat-actor)
• TraderTraitor (threat-actor)

Reports & references

• threatpost.com — 116422 (report)
• us-cert.gov — Ta17 164A (report)
• us-cert.gov — Ta17 318A (report)
• us-cert.gov — Ta17 318B (report)
• Kaspersky — 87553 (report)
• Kaspersky — 77908 (report)
• us-cert.gov — Hidden Cobra North Korean Malicious Cyber Activity (report)
• McAfee — Wp Dissecting Operation Troy (report)
• bleepingcomputer.com — North Korean Hackers Are Up To No Good Again (report)
• cfr.org — Lazarus Group (report)
• cfr.org — Operation Ghostsecret (report)
• cfr.org — Compromise Cryptocurrency Exchanges South Korea (report)
• bleepingcomputer.com — Lazarus Group Deploys Its First Mac Malware In Cryptocurrency Exchange Hack (report)
• Mandiant — Rpt Apt38 (report)
• blog.malwarebytes.com — The Advanced Persistent Threat Files Lazarus Group (report)
• theguardian.com — South Korea Cyber Attack (report)
• web.archive.org — Trojankoredos Comes Unwelcomed Surprise (report)
• nytimes.com — South Korea Computer Network Crashes (report)
• web.archive.org — South Korean Financial Companies Targeted Castov (report)
• web.archive.org — Four Years Darkseoul Cyberattacks Against South Korea Continue Anniversary Korean War (report)
• Trend Micro — The Hack Of Sony Pictures What You Need To Know (report)
• Trend Micro — New Killdisk Variant Hits Financial Organizations In Latin America (report)
• ESET — Lazarus Killdisk Central American Casino (report)
• McAfee — Hidden Cobra Targets Turkish Financial Sector New Bankshot Implant (report)
• McAfee — Analyzing Operation Ghostsecret Attack Seeks To Steal Data Worldwide (report)

Attributed from

• 2025 Bluenoroff Cryptocurrency Foundation Targeting (campaign)
• Citrine Sleet Chromium Zero-Day Exploit Activity (CVE-2024-7971) (campaign)
• Citrine Sleet Cryptocurrency Industry Attack (campaign)
• Contagious Interview (campaign)
• Operation Dream Job (campaign)
• Operation In(ter)ception (campaign)
• Operation Sharpshooter (campaign)
• TA455 Iranian Dream Job Campaign (campaign)
• VMConnect Lazarus Group Campaign (campaign)

External references

• mitre-attack — G0032
• Labyrinth Chollima
• Diamond Sleet
• ZINC
• Lazarus Group
• NICKEL ACADEMY
• Guardians of Peace
• CrowdStrike Labyrinth Chollima Feb 2022
• Mandiant DPRK Groups 2023
• Mandiant DPRK Laz Org Breakdown 2022
• Microsoft Threat Actor Naming July 2023
• Novetta Blockbuster
• Secureworks NICKEL ACADEMY Dec 2017
• Microsoft ZINC disruption Dec 2017
• HIDDEN COBRA
• Treasury North Korean Cyber Groups September 2019
• US-CERT HIDDEN COBRA June 2017
• US-CERT HOPLIGHT Apr 2019
• JPCert Blog Laz Subgroups 2025
• misp-galaxy