[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2T1NYcA27uxMT3QTYU50afgAwvfUDcFFRvul2TS7TVs":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":48,"country":49,"suspected_sponsor":50,"target_industries":51,"target_countries":54,"incident_types":73,"references":74,"techniques":142,"technique_count":299,"created_at":300,"seoMetadata":301,"schemaOrg":305},"Lazarus Group","lazarus-group",[9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"Operation DarkSeoul","Dark Seoul","Hidden Cobra","Hastati Group","Andariel","Unit 121","Bureau 121","NewRomanic Cyber Army Team","Bluenoroff","Subgroup: Bluenoroff","Group 77","Labyrinth Chollima","Operation Troy","Operation GhostSecret","Operation AppleJeus","APT38","APT 38","Stardust Chollima","Whois Hacking Team","Zinc","Appleworm","Nickel Academy","APT-C-26","NICKEL GLADSTONE","COVELLITE","ATK3","G0032","ATK117","G0082","Citrine Sleet","DEV-0139","DEV-1222","Diamond Sleet","ZINC","Sapphire Sleet","COPERNICIUM","TA404","Lazarus group","BeagleBoyz","Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.","KP","Korea (Democratic People's Republic of)",[52,53],"Government","Private sector",[55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,59,71,72],"South Korea","Bangladesh Bank","Sony Pictures Entertainment","United States","Thailand","France","China","Hong Kong","United Kingdom","Guatemala","Canada","Bangladesh","Japan","India","Germany","Brazil","Australia","Cryptocurrency exchanges in South Korea",[],[75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"https:\u002F\u002Fthreatpost.com\u002Foperation-blockbuster-coalition-ties-destructive-attacks-to-lazarus-group\u002F116422\u002F","https:\u002F\u002Fwww.us-cert.gov\u002Fncas\u002Falerts\u002FTA17-164A","https:\u002F\u002Fwww.us-cert.gov\u002Fncas\u002Falerts\u002FTA17-318A","https:\u002F\u002Fwww.us-cert.gov\u002Fncas\u002Falerts\u002FTA17-318B","https:\u002F\u002Fsecurelist.com\u002Foperation-applejeus\u002F87553\u002F","https:\u002F\u002Fsecurelist.com\u002Flazarus-under-the-hood\u002F77908\u002F","https:\u002F\u002Fwww.us-cert.gov\u002FHIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity","https:\u002F\u002Fwww.mcafee.com\u002Fenterprise\u002Fen-us\u002Fassets\u002Fwhite-papers\u002Fwp-dissecting-operation-troy.pdf","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnorth-korean-hackers-are-up-to-no-good-again\u002F","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Flazarus-group","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Foperation-ghostsecret","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Fcompromise-cryptocurrency-exchanges-south-korea","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack\u002F","https:\u002F\u002Fcontent.fireeye.com\u002Fapt\u002Frpt-apt38","https:\u002F\u002Fblog.malwarebytes.com\u002Fthreat-analysis\u002F2019\u002F03\u002Fthe-advanced-persistent-threat-files-lazarus-group\u002F","https:\u002F\u002Fwww.theguardian.com\u002Fworld\u002F2009\u002Fjul\u002F08\u002Fsouth-korea-cyber-attack","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20131123012339\u002Fhttps:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Ftrojankoredos-comes-unwelcomed-surprise","https:\u002F\u002Fwww.nytimes.com\u002F2013\u002F03\u002F21\u002Fworld\u002Fasia\u002Fsouth-korea-computer-network-crashes.html","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20130607233212\u002Fhttps:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Fsouth-korean-financial-companies-targeted-castov","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20130701021735\u002Fhttps:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Ffour-years-darkseoul-cyberattacks-against-south-korea-continue-anniversary-korean-war","https:\u002F\u002Fwww.trendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fcyber-attacks\u002Fthe-hack-of-sony-pictures-what-you-need-to-know","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fnew-killdisk-variant-hits-financial-organizations-in-latin-america\u002F","https:\u002F\u002Fwww.welivesecurity.com\u002F2018\u002F04\u002F03\u002Flazarus-killdisk-central-american-casino\u002F","https:\u002F\u002Fsecuringtomorrow.mcafee.com\u002Fother-blogs\u002Fmcafee-labs\u002Fhidden-cobra-targets-turkish-financial-sector-new-bankshot-implant\u002F","https:\u002F\u002Fsecuringtomorrow.mcafee.com\u002Fother-blogs\u002Fmcafee-labs\u002Fanalyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide\u002F","https:\u002F\u002Fwww.us-cert.gov\u002Fncas\u002Fanalysis-reports\u002FAR19-129A","https:\u002F\u002Fsecuringtomorrow.mcafee.com\u002Fother-blogs\u002Fmcafee-labs\u002Foperation-sharpshooter-targets-global-defense-critical-infrastructure\u002F","https:\u002F\u002Fsecurelist.com\u002Fcryptocurrency-businesses-still-being-targeted-by-lazarus\u002F90019\u002F","https:\u002F\u002Fwww.theregister.co.uk\u002F2019\u002F04\u002F10\u002Flazarus_group_malware\u002F","https:\u002F\u002Fwww.operationblockbuster.com\u002Fwp-content\u002Fuploads\u002F2016\u002F02\u002FOperation-Blockbuster-Report.pdf","https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fnorth-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and","https:\u002F\u002Fwww.trendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fcybercrime-and-digital-threats\u002Fa-look-into-the-lazarus-groups-operations","https:\u002F\u002Fwww.kaspersky.com\u002Fabout\u002Fpress-releases\u002F2017_chasing-lazarus-a-hunt-for-the-infamous-hackers-to-prevent-large-bank-robberies","https:\u002F\u002Fmedium.com\u002Fthreat-intel\u002Flazarus-attacks-wannacry-5fdeddee476c","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0032\u002F","https:\u002F\u002Fthreatpost.com\u002Flazarus-apt-spinoff-linked-to-banking-hacks\u002F124746\u002F","https:\u002F\u002Fcommunity.broadcom.com\u002Fsymantecenterprise\u002Fcommunities\u002Fcommunity-home\u002Flibrarydocuments\u002Fviewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments","https:\u002F\u002Fwww.bankinfosecurity.com\u002Fvietnamese-bank-blocks-1-million-online-heist-a-9105","https:\u002F\u002Fwww.reuters.com\u002Farticle\u002Fus-cyber-heist-swift-specialreport-idUSKCN0YB0DD","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20160527050022\u002Fhttps:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Fswift-attackers-malware-linked-more-financial-attacks","https:\u002F\u002Fsymantec-blogs.broadcom.com\u002Fblogs\u002Fthreat-intelligence\u002Ffastcash-lazarus-atm-malware","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fwhat-we-can-learn-from-the-bangladesh-central-bank-cyber-heist\u002F","https:\u002F\u002Fwww.symantec.com\u002Fconnect\u002Fblogs\u002Fattackers-target-dozens-global-banks-new-malware","https:\u002F\u002Fbaesystemsai.blogspot.com\u002F2017\u002F10\u002Ftaiwan-heist-lazarus-tools.html","https:\u002F\u002Fwww.bloomberg.com\u002Fnews\u002Farticles\u002F2018-05-29\u002Fmexico-foiled-a-110-million-bank-heist-then-kept-it-a-secret","https:\u002F\u002Fthreatpost.com\u002Fbanco-de-chile-wiper-attack-just-a-cover-for-10m-swift-heist\u002F132796\u002F","https:\u002F\u002Fwww.darkreading.com\u002Fattacks-breaches\u002Fnorth-korean-hacking-group-steals-$135-million-from-indian-bank-\u002Fd\u002Fd-id\u002F1332678","https:\u002F\u002Fwww.zdnet.com\u002Farticle\u002Fnorth-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview\u002F","https:\u002F\u002Fblogs.jpcert.or.jp\u002Fen\u002F2020\u002F08\u002FLazarus-malware.html","https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fnickel-gladstone","https:\u002F\u002Fblogs.jpcert.or.jp\u002Fen\u002F2020\u002F09\u002FBLINDINGCAN.html","https:\u002F\u002Fwww.welivesecurity.com\u002F2020\u002F11\u002F16\u002Flazarus-supply-chain-attack-south-korea\u002F","https:\u002F\u002Fdragos.com\u002Fadversaries.html","https:\u002F\u002Fdragos.com\u002Fmedia\u002F2017-Review-Industrial-Control-System-Threats.pdf","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Fcovellite","https:\u002F\u002Fwww.hvs-consulting.de\u002Flazarus-report\u002F","https:\u002F\u002Fgithub.com\u002Fhvs-consulting\u002Fioc_signatures\u002Ftree\u002Fmain\u002FLazarus_APT37","https:\u002F\u002Fblogs.jpcert.or.jp\u002Fen\u002F2021\u002F01\u002FLazarus_tools.html","https:\u002F\u002Fblogs.jpcert.or.jp\u002Fen\u002F2021\u002F01\u002FLazarus_malware2.html","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0082","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0032","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2022\u002F12\u002F06\u002Fdev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry\u002F","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fblog\u002Fthreat-insight\u002Fta444-apt-startup-aimed-at-your-funds","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fblog\u002Fthreat-insight\u002Fabove-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists","https:\u002F\u002Fwww.bsi.bund.de\u002FDE\u002FThemen\u002FUnternehmen-und-Organisationen\u002FCyber-Sicherheitslage\u002FAnalysen-und-Prognosen\u002FThreat-Intelligence\u002FAktive_APT-Gruppen\u002Faktive-apt-gruppen_node.html","https:\u002F\u002Fwww.securonix.com\u002Fblog\u002Fsecuronix-threat-labs-monthly-intelligence-insights-june-2023\u002F","https:\u002F\u002Fus-cert.cisa.gov\u002Fncas\u002Falerts\u002Faa21-048a",[143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298],"T1134","T1134.002","T1087","T1087.002","T1098","T1583","T1583.001","T1583.004","T1583.006","T1557","T1557.001","T1071","T1124","T1071.001","T1010","T1560","T1560.001","T1560.002","T1560.003","T1547","T1547.001","T1547.009","T1110","T1110.003","T1059","T1059.001","T1059.003","T1059.005","T1584","T1584.001","T1584.004","T1543","T1543.003","T1485","T1132","T1132.001","T1005","T1001","T1001.003","T1074","T1074.001","T1622","T1491","T1491.001","T1140","T1587","T1587.001","T1587.002","T1561","T1561.001","T1561.002","T1189","T1573","T1573.001","T1585","T1585.001","T1585.002","T1048","T1048.003","T1041","T1567","T1567.002","T1203","T1008","T1083","T1589","T1589.002","T1591","T1591.004","T1564","T1564.001","T1574","T1574.013","T1070","T1070.003","T1070.004","T1070.006","T1202","T1105","T1056","T1056.001","T1534","T1036","T1036.003","T1036.004","T1036.005","T1036.008","T1104","T1106","T1046","T1571","T1027","T1027.002","T1027.007","T1027.013","T1588","T1588.002","T1588.003","T1588.004","T1566","T1566.001","T1566.002","T1566.003","T1542","T1542.003","T1057","T1055","T1055.001","T1090","T1090.001","T1090.002","T1012","T1620","T1021","T1021.001","T1021.002","T1021.004","T1053","T1053.005","T1593","T1593.001","T1505","T1505.004","T1489","T1608","T1608.001","T1608.002","T1553","T1553.002","T1218","T1218.005","T1218.010","T1218.011","T1082","T1614","T1614.001","T1016","T1049","T1033","T1529","T1221","T1204","T1204.001","T1204.002","T1078","T1497","T1497.001","T1497.003","T1102","T1102.002","T1047","T1220","T1574.001","T1685","T1686","T1684.001",156,"2023-08-09T17:25:09.409843+00:00",{"title":302,"metaDescription":303,"keywords":304},"Lazarus Group Threat Actor Profile | EdgeProtect","Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the ex...","Lazarus Group, Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Subgroup: Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Operation AppleJeus, APT38, APT 38, Stardust Chollima, Whois Hacking Team, Zinc, Appleworm, Nickel Academy, APT-C-26, NICKEL GLADSTONE, COVELLITE, ATK3, G0032, ATK117, G0082, Citrine Sleet, DEV-0139, DEV-1222, Diamond Sleet, ZINC, Sapphire Sleet, COPERNICIUM, TA404, Lazarus group, BeagleBoyz, threat actor, APT, cyber threat, threat intelligence, Government, Private sector, Korea (Democratic People's Republic of), KP",{"@context":306,"@type":307,"name":6,"alternateName":308,"description":48,"url":309,"mainEntityOfPage":310,"location":312},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Flazarus-group",{"@type":311,"@id":309},"WebPage",{"@type":313,"name":49},"Country"]