# Lazarus Group: threat group profile

> Lazarus Group is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 80 attack techniques, and to attacks on government and private sector organisations, with 18 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.edgeprotect.io/threat-actors/lazarus-group
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > Lazarus Group

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 80 (plus 77 sub-techniques) |
| Countries and victims named | 18 |
| Thought to operate from | North Korea |
| Suspected backing | North Korea |
| Other names | 38 |
| Public reports | 67 |

## Who is Lazarus Group?

Lazarus Group is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 80 attack techniques, and to attacks on government and private sector organisations, with 18 countries and victims named.

### Also known as

Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Subgroup: Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Operation AppleJeus, APT38, APT 38, Stardust Chollima, Whois Hacking Team, Zinc, Appleworm, Nickel Academy, APT-C-26, NICKEL GLADSTONE, COVELLITE, ATK3, G0032, ATK117, G0082, Citrine Sleet, DEV-0139, DEV-1222, Diamond Sleet, ZINC, Sapphire Sleet, COPERNICIUM, TA404, BeagleBoyz

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

## How does Lazarus Group attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 80 linked to Lazarus Group. Some techniques belong to more than one stage. Public reporting also lists 77 more specific variations of them, called sub-techniques.

### 1. Research (3)

- T1589: Gather Victim Identity Information
- T1591: Gather Victim Org Information
- T1593: Search Open Websites/Domains

### 2. Preparation (6)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1585: Establish Accounts
- T1587: Develop Capabilities
- T1588: Obtain Capabilities
- T1608: Stage Capabilities

### 3. Getting in (3)

- T1078: Valid Accounts
- T1189: Drive-by Compromise
- T1566: Phishing

### 4. Running code (7)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1106: Native API
- T1203: Exploitation for Client Execution
- T1204: User Execution
- T1574: Hijack Execution Flow

### 5. Staying in (7)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1505: Server Software Component
- T1542: Pre-OS Boot
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (7)

- T1053: Scheduled Task/Job
- T1055: Process Injection
- T1078: Valid Accounts
- T1098: Account Manipulation
- T1134: Access Token Manipulation
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (18)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1055: Process Injection
- T1070: Indicator Removal
- T1078: Valid Accounts
- T1134: Access Token Manipulation
- T1140: Deobfuscate/Decode Files or Information
- T1202: Indirect Command Execution
- T1218: System Binary Proxy Execution
- T1220: XSL Script Processing
- T1221: Template Injection
- T1497: Virtualization/Sandbox Evasion
- T1542: Pre-OS Boot
- T1564: Hide Artifacts
- T1574: Hijack Execution Flow
- T1620: Reflective Code Loading
- T1622: Debugger Evasion
- T1684: Social Engineering

### 8. Disabling defences (3)

- T1553: Subvert Trust Controls
- T1685: Disable or Modify Tools
- T1686: Disable or Modify System Firewall

### 9. Stealing passwords (3)

- T1056: Input Capture
- T1110: Brute Force
- T1557: Adversary-in-the-Middle

### 10. Looking around (14)

- T1010: Application Window Discovery
- T1012: Query Registry
- T1016: System Network Configuration Discovery
- T1033: System Owner/User Discovery
- T1046: Network Service Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1124: System Time Discovery
- T1497: Virtualization/Sandbox Evasion
- T1614: System Location Discovery
- T1622: Debugger Evasion

### 11. Spreading (2)

- T1021: Remote Services
- T1534: Internal Spearphishing

### 12. Gathering data (5)

- T1005: Data from Local System
- T1056: Input Capture
- T1074: Data Staged
- T1557: Adversary-in-the-Middle
- T1560: Archive Collected Data

### 13. Keeping contact (10)

- T1001: Data Obfuscation
- T1008: Fallback Channels
- T1071: Application Layer Protocol
- T1090: Proxy
- T1102: Web Service
- T1104: Multi-Stage Channels
- T1105: Ingress Tool Transfer
- T1132: Data Encoding
- T1571: Non-Standard Port
- T1573: Encrypted Channel

### 14. Taking data out (3)

- T1041: Exfiltration Over C2 Channel
- T1048: Exfiltration Over Alternative Protocol
- T1567: Exfiltration Over Web Service

### 15. Causing damage (5)

- T1485: Data Destruction
- T1489: Service Stop
- T1491: Defacement
- T1529: System Shutdown/Reboot
- T1561: Disk Wipe

## Who does Lazarus Group go after?

**Sectors:** Government, Private sector

**Countries and victims named:** South Korea, Bangladesh Bank, Sony Pictures Entertainment, United States, Thailand, France, China, Hong Kong, United Kingdom, Guatemala, Canada, Bangladesh, Japan, India, Germany, Brazil, Australia, Cryptocurrency exchanges in South Korea

See threats by industry: https://www.edgeprotect.io/industries

## Public reports about Lazarus Group

- https://threatpost.com/operation-blockbuster-coalition-ties-destructive-attacks-to-lazarus-group/116422/
- https://www.us-cert.gov/ncas/alerts/TA17-164A
- https://www.us-cert.gov/ncas/alerts/TA17-318A
- https://www.us-cert.gov/ncas/alerts/TA17-318B
- https://securelist.com/operation-applejeus/87553/
- https://securelist.com/lazarus-under-the-hood/77908/
- https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
- https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf
- https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/
- https://www.cfr.org/interactive/cyber-operations/lazarus-group
- https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret
- https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea
- https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/
- https://content.fireeye.com/apt/rpt-apt38
- https://blog.malwarebytes.com/threat-analysis/2019/03/the-advanced-persistent-threat-files-lazarus-group/
- https://www.theguardian.com/world/2009/jul/08/south-korea-cyber-attack
- https://web.archive.org/web/20131123012339/https://www.symantec.com/connect/blogs/trojankoredos-comes-unwelcomed-surprise
- https://www.nytimes.com/2013/03/21/world/asia/south-korea-computer-network-crashes.html
- https://web.archive.org/web/20130607233212/https://www.symantec.com/connect/blogs/south-korean-financial-companies-targeted-castov
- https://web.archive.org/web/20130701021735/https://www.symantec.com/connect/blogs/four-years-darkseoul-cyberattacks-against-south-korea-continue-anniversary-korean-war
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/the-hack-of-sony-pictures-what-you-need-to-know
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-killdisk-variant-hits-financial-organizations-in-latin-america/
- https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/
- https://www.us-cert.gov/ncas/analysis-reports/AR19-129A
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/
- https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/
- https://www.theregister.co.uk/2019/04/10/lazarus_group_malware/
- https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf
- https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/a-look-into-the-lazarus-groups-operations
- https://www.kaspersky.com/about/press-releases/2017_chasing-lazarus-a-hunt-for-the-infamous-hackers-to-prevent-large-bank-robberies
- https://medium.com/threat-intel/lazarus-attacks-wannacry-5fdeddee476c
- https://attack.mitre.org/groups/G0032/
- https://threatpost.com/lazarus-apt-spinoff-linked-to-banking-hacks/124746/
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
- https://www.bankinfosecurity.com/vietnamese-bank-blocks-1-million-online-heist-a-9105
- https://www.reuters.com/article/us-cyber-heist-swift-specialreport-idUSKCN0YB0DD
- https://web.archive.org/web/20160527050022/https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
- https://blog.trendmicro.com/trendlabs-security-intelligence/what-we-can-learn-from-the-bangladesh-central-bank-cyber-heist/
- https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware
- https://baesystemsai.blogspot.com/2017/10/taiwan-heist-lazarus-tools.html
- https://www.bloomberg.com/news/articles/2018-05-29/mexico-foiled-a-110-million-bank-heist-then-kept-it-a-secret
- https://threatpost.com/banco-de-chile-wiper-attack-just-a-cover-for-10m-swift-heist/132796/
- https://www.darkreading.com/attacks-breaches/north-korean-hacking-group-steals-$135-million-from-indian-bank-/d/d-id/1332678
- https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/
- https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html
- https://www.secureworks.com/research/threat-profiles/nickel-gladstone
- https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html
- https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/
- https://dragos.com/adversaries.html
- https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf
- https://www.cfr.org/interactive/cyber-operations/covellite
- https://www.hvs-consulting.de/lazarus-report/
- https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37
- https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html
- https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html
- https://attack.mitre.org/groups/G0082
- https://attack.mitre.org/groups/G0032
- https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/
- https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds
- https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-june-2023/
- https://us-cert.cisa.gov/ncas/alerts/aa21-048a

## Frequently asked questions

### Who is Lazarus Group?

Lazarus Group is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 80 attack techniques, and to attacks on government and private sector organisations, with 18 countries and victims named.

### Where is Lazarus Group thought to be based?

Public reporting places Lazarus Group as operating from North Korea, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Lazarus Group target?

In public reporting, sectors named include government and private sector, and 18 countries and victims are named, including South Korea, Bangladesh Bank, Sony Pictures Entertainment and United States.

### How does Lazarus Group attack?

Public reporting links Lazarus Group to 80 attack techniques. Most of them are about hiding, looking around and keeping contact.

### How do I know if Lazarus Group is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact