Lazarus Group

Overview

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.

Naming & attribution

Lazarus Group is tracked under 7 names across the industry. It uses 93 documented ATT&CK techniques — more than 98% of the 174 groups tracked here. Activity attributed since at least 2009.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1574.013 KernelCallbackTable — used by 1 of 174 groups
• T1134.002 Create Process with Token — used by 2 of 174 groups
• T1202 Indirect Command Execution — used by 2 of 174 groups
• T1218 System Binary Proxy Execution — used by 2 of 174 groups
• T1557.001 Name Resolution Poisoning and SMB Relay — used by 2 of 174 groups
• T1560.002 Archive via Library — used by 2 of 174 groups
• T1001.003 Protocol or Service Impersonation — used by 3 of 174 groups
• T1010 Application Window Discovery — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT32 Vietnam — 42 shared techniques (33% overlap)
• Mustang Panda China — 41 shared techniques (30% overlap)
• Magic Hound Iran — 38 shared techniques (29% overlap)
• Kimsuky North Korea — 49 shared techniques (28% overlap)
• FIN7 — 35 shared techniques (28% overlap)
• MuddyWater Iran — 35 shared techniques (28% overlap)

Targets

Government · Private sector

Regions

Australia · Bangladesh · Bangladesh Bank · Brazil · Canada · China · Cryptocurrency exchanges in South Korea · France · Germany · Guatemala · Hong Kong · India · Japan · Sony Pictures Entertainment · South Korea · Thailand · United Kingdom · United States

Capabilities

• Destructive / data-wiping operations — ATT&CK T1485, T1561.001, T1561.002
• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 22 attributed custom malware families

TTPs — 93 techniques across 14 tactics

Tools & malware (26)

RawDisk · Proxysvc · BADCALL · FALLCHILL · WannaCry · MagicRAT · HOPLIGHT · TYPEFRAME · Dtrack · HotCroissant · HARDRAIN · Dacls · KEYMARBLE · TAINTEDSCRIBE · AuditCred · netsh · ECCENTRICBANDWAGON · AppleJeus · route · BLINDINGCAN · ThreatNeedle · Volgmer · Cryptoistic · Responder · RATANKBA · Bankshot

Reporting (3)

• Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup — 佐々木勇人 Hayato Sasaki
• Assessed Cyber Structure and Alignments of North Korea in 2023 — Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez
• How Microsoft names threat actors — Microsoft