Threat Intelligence Report: Lazarus Group

Automated AI-generated threat intelligence report for Lazarus Group.

Loading IOCs…

{'aliases': ['Lazarus Group',
             'Labyrinth Chollima',
             'HIDDEN COBRA',
             'Guardians of Peace',
             'ZINC',
             'NICKEL ACADEMY',
             'Diamond Sleet'],
 'created': '2017-05-31T21:32:03.807Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Lazarus Group](https://attack.mitre.org/groups/G0032) is a '
                'North Korean state-sponsored cyber threat group attributed to '
                'the Reconnaissance General Bureau (RGB). (Citation: US-CERT '
                'HIDDEN COBRA June 2017) (Citation: Treasury North Korean '
                'Cyber Groups September 2019) [Lazarus '
                'Group](https://attack.mitre.org/groups/G0032) has been active '
                'since at least 2009 and is reportedly responsible for the '
                'November 2014 destructive wiper attack on Sony Pictures '
                'Entertainment, identified by Novetta as part of Operation '
                'Blockbuster. Malware used by [Lazarus '
                'Group](https://attack.mitre.org/groups/G0032) correlates to '
                'other reported campaigns, including Operation Flame, '
                'Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days '
                'of Rain.(Citation: Novetta Blockbuster)\n'
                '\n'
                'North Korea’s cyber operations have shown a consistent '
                'pattern of adaptation, forming and reorganizing units as '
                'national priorities shift. These units frequently share '
                'personnel, infrastructure, malware, and tradecraft, making it '
                'difficult to attribute specific operations with high '
                'confidence. Public reporting often uses “Lazarus Group” as an '
                'umbrella term for multiple North Korean cyber operators '
                'conducting espionage, destructive attacks, and financially '
                'motivated campaigns.(Citation: Mandiant DPRK Laz Org '
                'Breakdown 2022)(Citation: Mandiant DPRK Groups '
                '2023)(Citation: JPCert Blog Laz Subgroups 2025)\n'
                '\n',
 'external_references': [{'external_id': 'G0032',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0032'},
                         {'description': '(Citation: CrowdStrike Labyrinth '
                                         'Chollima Feb 2022)',
                          'source_name': 'Labyrinth Chollima'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'Diamond Sleet'},
                         {'description': '(Citation: Microsoft ZINC disruption '
                                         'Dec 2017)',
                          'source_name': 'ZINC'},
                         {'description': '(Citation: Novetta Blockbuster)',
                          'source_name': 'Lazarus Group'},
                         {'description': '(Citation: Secureworks NICKEL '
                                         'ACADEMY Dec 2017)',
                          'source_name': 'NICKEL ACADEMY'},
                         {'description': '(Citation: US-CERT HIDDEN COBRA June '
                                         '2017)',
                          'source_name': 'Guardians of Peace'},
                         {'description': 'CrowdStrike. (2022, February 1). '
                                         'CrowdStrike Adversary Labyrinth '
                                         'Chollima. Retrieved February 1, '
                                         '2022.',
                          'source_name': 'CrowdStrike Labyrinth Chollima Feb '
                                         '2022',
                          'url': 'https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/'},
                         {'description': 'Michael Barnhart, Austin Larsen, '
                                         'Jeff Johnson, Taylor Long, Michelle '
                                         'Cantos, Adrian Hernandez. (2023, '
                                         'October 10). Assessed Cyber '
                                         'Structure and Alignments of North '
                                         'Korea in 2023. Retrieved August 25, '
                                         '2025.',
                          'source_name': 'Mandiant DPRK Groups 2023',
                          'url': 'https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023'},
                         {'description': 'Michael Barnhart, Michelle Cantos, '
                                         'Jeffery Johnson, Elias fox, Gary '
                                         'Freas, Dan Scott. (2022, March 23). '
                                         'Not So Lazarus: Mapping DPRK Cyber '
                                         'Threat Groups to Government '
                                         'Organizations. Retrieved September '
                                         '9, 2025.',
                          'source_name': 'Mandiant DPRK Laz Org Breakdown 2022',
                          'url': 'https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
                         {'description': 'Novetta Threat Research Group. '
                                         '(2016, February 24). Operation '
                                         'Blockbuster: Unraveling the Long '
                                         'Thread of the Sony Attack. Retrieved '
                                         'February 25, 2016.',
                          'source_name': 'Novetta Blockbuster',
                          'url': 'https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf'},
                         {'description': 'Secureworks. (2017, December 15). '
                                         'Media Alert - Secureworks Discovers '
                                         'North Korean Cyber Threat Group, '
                                         'Lazarus, Spearphishing Financial '
                                         'Executives of Cryptocurrency '
                                         'Companies. Retrieved December 27, '
                                         '2017.',
                          'source_name': 'Secureworks NICKEL ACADEMY Dec 2017',
                          'url': 'https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing'},
                         {'description': 'Smith, B. (2017, December 19). '
                                         'Microsoft and Facebook disrupt ZINC '
                                         'malware attack to protect customers '
                                         'and the internet from ongoing '
                                         'cyberthreats. Retrieved December 20, '
                                         '2017.',
                          'source_name': 'Microsoft ZINC disruption Dec 2017',
                          'url': 'https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/'},
                         {'description': 'The U.S. Government refers to '
                                         'malicious cyber activity by the '
                                         'North Korean government as HIDDEN '
                                         'COBRA.(Citation: US-CERT HIDDEN '
                                         'COBRA June 2017)(Citation: US-CERT '
                                         'HOPLIGHT Apr 2019)',
                          'source_name': 'HIDDEN COBRA'},
                         {'description': 'US Treasury . (2019, September 13). '
                                         'Treasury Sanctions North Korean '
                                         'State-Sponsored Malicious Cyber '
                                         'Groups. Retrieved September 29, '
                                         '2021.',
                          'source_name': 'Treasury North Korean Cyber Groups '
                                         'September 2019',
                          'url': 'https://home.treasury.gov/news/press-releases/sm774'},
                         {'description': 'US-CERT. (2017, June 13). Alert '
                                         '(TA17-164A) HIDDEN COBRA – North '
                                         'Korea’s DDoS Botnet Infrastructure. '
                                         'Retrieved July 13, 2017.',
                          'source_name': 'US-CERT HIDDEN COBRA June 2017',
                          'url': 'https://www.us-cert.gov/ncas/alerts/TA17-164A'},
                         {'description': 'US-CERT. (2019, April 10). '
                                         'MAR-10135536-8 – North Korean '
                                         'Trojan: HOPLIGHT. Retrieved April '
                                         '19, 2019.',
                          'source_name': 'US-CERT HOPLIGHT Apr 2019',
                          'url': 'https://www.us-cert.gov/ncas/analysis-reports/AR19-100A'},
                         {'description': '佐々木勇人 Hayato Sasaki. (2025, March '
                                         '25). Tempted to Classifying APT '
                                         'Actors: Practical Challenges of '
                                         'Attribution in the Case of Lazarus’s '
                                         'Subgroup. Retrieved August 25, 2025.',
                          'source_name': 'JPCert Blog Laz Subgroups 2025',
                          'url': 'https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html'}],
 'id': 'intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a',
 'modified': '2025-10-24T01:29:21.748Z',
 'name': 'Lazarus Group',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_contributors': ['Kyaw Pyiyt Htet, @KyawPyiytHtet',
                          'Dragos Threat Intelligence',
                          'MyungUk Han, ASEC',
                          'Jun Hirata, NEC Corporation',
                          'Manikantan Srinivasan, NEC Corporation India',
                          'Pooja Natarajan, NEC Corporation India'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'ics-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '5.0'}