Lazarus

Lazarus Group is a North Korean state-sponsored cyber threat actor active since at least 2009 and linked to the Reconnaissance General Bureau. It conducts cyberespionage, financial theft, and destructive operations. Financial campaigns generate revenue for the North Korean government, including support for weapons programs and sanctions evasion. Lazarus frequently serves as an umbrella designation for related operational teams rather than a single crew, and vendor tracking boundaries differ. Associated names include Labyrinth Chollima, ZINC, Diamond Sleet, NICKEL ACADEMY, and Guardians of Peace. HIDDEN COBRA is a broader U.S. government designation for malicious North Korean government cyber activity. Related teams commonly grouped under the umbrella include financially focused BlueNoroff, Andariel, and cryptocurrency-theft operation TraderTraitor; these labels are not interchangeable across all campaigns. Targets include banks, cryptocurrency exchanges and service providers, technology companies, government agencies, defense and aerospace organizations, telecommunications providers, energy organizations, pharmaceutical companies, and security researchers. Notable attributed operations include the destructive 2014 Sony Pictures attack, the 2016 Bangladesh Bank theft, the 2017 WannaCry ransomware outbreak, and cryptocurrency thefts involving Ronin Network, Harmony Horizon, and Bybit. Initial-access techniques include spearphishing, strategic website compromises, vulnerability exploitation, trojanized applications, and software supply-chain compromise. Operation Dream Job and related recruitment campaigns use fabricated professional identities, fictitious employment opportunities, and malicious coding assignments to induce execution. Cryptocurrency-focused operations also compromise third-party providers and manipulate transaction-signing interfaces or approval workflows. Stolen session cookies have enabled impersonation of legitimate employees. Post-compromise capabilities include credential harvesting, keylogging, privilege escalation, network discovery, lateral movement, persistent remote access, and data exfiltration. Operators use custom backdoors, scheduled tasks and services, DLL side-loading, process injection, encrypted command-and-control, proxies, and legitimate cloud services. Defense evasion includes payload obfuscation, signed malware, anti-analysis checks, log deletion, and secure removal of tools. Destructive operations have included disk and master boot record wiping, while other campaigns have employed DDoS or ransomware. Shared infrastructure, tooling, and personnel complicate precise attribution among Lazarus-associated teams.