Lazarus Group
Suspected sponsor: North Korea · ATT&CK G10367
APAC targets
30
Techniques
1
Incidents
5
News · 30d
Profile
Also known as: Andariel, AppleJeus, Appleworm, APT 38, APT-C-26, APT38, ATK117, ATK3, BeagleBoyz, Black Artemis, Bluenoroff, Bureau 121, Citrine Sleet, COPERNICIUM, COVELLITE, Dark Seoul, DEV-0139, DEV-1222, Diamond Sleet, G0032, G0082, Gleaming Pisces, Group 77, Guardians of Peace, Hastati Group, HIDDEN COBRA, Labyrinth Chollima, Moonstone Sleet, NewRomanic Cyber Army Team, NICKEL ACADEMY, NICKEL GLADSTONE, Onyx Sleet, Operation AppleJeus, Operation DarkSeoul, Operation GhostSecret, Operation Troy, PLUTONIUM, Sapphire Sleet, Silent Chollima, Stardust Chollima, Storm-1789, Subgroup: Bluenoroff, TA404, UNC1720, UNC4736, Unit 121, Whois Hacking Team, ZINC
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.
Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.
ATT&CK techniques · 30
Reconnaissance
Resource Development
Initial Access
Persistence
Stealth
Credential Access
Discovery
Command and Control
Incidents attributed
In the news · last mention Nov 9
- M’sia must step up vigilance against state-linked hackers, says MCCA
- Malaysia needs to increase vigilance against professional hacker threats, says association MS
- Binance resumes withdrawals after more than US$6bil stolen in hack
- FBI says North Korea behind US$6bil crypto theft from Binance
- Tracking AI adoption in North Korean threat actor tradecraft
Targets
Australia
China
Hong Kong
India
Japan
South Korea
ThailandElsewhere: Bangladesh, Brazil, Canada, Germany, France, United Kingdom, Guatemala, United States
Sectors: Government, Private sector
Relevance to the EU
EU relevance: High
EU cyber sanctions since July 2020 (WannaCry)
37 EU cooperation projects in the Asia-Pacific countries this actor targets: