Threat intelligence / Group

Lazarus Group

[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

120 recorded

Relationships

attributed-to

from Operation Dream Job

Campaign

uses

to Account Manipulation

Technique

uses

to AppleJeus

Malware

uses

to Application Window Discovery

Technique

uses

to Archive Collected Data

Technique

uses

to Archive via Custom Method

Technique

uses

to Archive via Library

Technique

uses

to AuditCred

Malware

uses

to BADCALL

Malware

uses

to Bankshot

Malware

uses

to Bidirectional Communication

Technique

uses

to BLINDINGCAN

Malware

uses

to Bootkit

Technique

uses

to Clear Command History

Technique

uses

to Code Signing

Technique

uses

to Create Process with Token

Technique

uses

to Cryptoistic

Malware

uses

to Dacls

Malware

uses

to Data Destruction

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Digital Certificates

Technique

uses

to Disable or Modify Tools

Technique

uses

to Disk Content Wipe

Technique

uses

to Disk Structure Wipe

Technique

uses

to DLL

Technique

uses

to Domains

Technique

uses

to Drive-by Compromise

Technique

uses

to Dtrack

Malware

uses

to Dynamic API Resolution

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to ECCENTRICBANDWAGON

Malware

uses

to Email Accounts

Technique

uses

to Email Addresses

Technique

uses

to Embedded Payloads

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Client Execution

Technique

uses

to External Proxy

Technique

uses

to Fallback Channels

Technique

uses

to FALLCHILL

Malware

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Gather Victim Org Information

Technique

uses

to HARDRAIN

Malware

uses

to Hidden Files and Directories

Technique

uses

to HOPLIGHT

Malware

uses

to HotCroissant

Malware

uses

to Indicator Removal

Technique

uses

to Indirect Command Execution

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Defacement

Technique

uses

to Internal Proxy

Technique

uses

to KernelCallbackTable

Technique

uses

to Keylogging

Technique

uses

to KEYMARBLE

Malware

uses

to Local Data Staging

Technique

uses

to Local Storage Discovery

Technique

uses

to MagicRAT

Malware

uses

to Malicious File

Technique

uses

to Malware

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mshta

Technique

uses

to Multi-Stage Channels

Technique

uses

to Name Resolution Poisoning and SMB Relay

Technique

uses

to Native API

Technique

uses

to netsh

Tool

uses

to Network Service Discovery

Technique

uses

to Non-Standard Port

Technique

uses

to Password Spraying

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Protocol or Service Impersonation

Technique

uses

to Proxysvc

Malware

uses

to Query Registry

Technique

uses

to RATANKBA

Malware

uses

to RawDisk

Tool

uses

to Reflective Code Loading

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Rename Legitimate Utilities

Technique

uses

to Responder

Tool

uses

to route

Tool

uses

to Rundll32

Technique

uses

to Scheduled Task

Technique

uses

to Server

Technique

uses

to Service Stop

Technique

uses

to Shortcut Modification

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Social Media Accounts

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing via Service

Technique

uses

to SSH

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Binary Proxy Execution

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to System Time Discovery

Technique

uses

to TAINTEDSCRIBE

Malware

uses

to ThreatNeedle

Malware

uses

to Timestomp

Technique

uses

to Tool

Technique

uses

to TYPEFRAME

Malware

uses

to Valid Accounts

Technique

uses

to Visual Basic

Technique

uses

to Volgmer

Malware

uses

to WannaCry

Malware

uses

to Web Protocols

Technique

uses

to Web Services

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

19 external

References

mitre-attack

G0032

open

Labyrinth Chollima

—

Diamond Sleet

—

ZINC

—

Lazarus Group

—

NICKEL ACADEMY

—

Guardians of Peace

—

CrowdStrike Labyrinth Chollima Feb 2022

https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/

open

Mandiant DPRK Groups 2023

https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023

open

Mandiant DPRK Laz Org Breakdown 2022

https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Novetta Blockbuster

https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf

open

Secureworks NICKEL ACADEMY Dec 2017

https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing

open

Microsoft ZINC disruption Dec 2017

https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/

open

HIDDEN COBRA

—

Treasury North Korean Cyber Groups September 2019

https://home.treasury.gov/news/press-releases/sm774

open

US-CERT HIDDEN COBRA June 2017

https://www.us-cert.gov/ncas/alerts/TA17-164A

open

US-CERT HOPLIGHT Apr 2019

https://www.us-cert.gov/ncas/analysis-reports/AR19-100A

open

JPCert Blog Laz Subgroups 2025

https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html

open