Log in Request a demo

Threat group profile

Lazarus Group

Also known as HIDDEN COBRA, Diamond Sleet, ZINC

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau.

In short

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. The US charged three RGB members in 2020 and 2021 with attempts to steal or extort more than $1.3 billion, and the FBI attributed the 2025 Bybit theft to North Korean actors it tracks as TraderTraitor.

Last updated 7 October 2026

Profile MapThreat Group
  1. Attributed OriginNorth Korea
  2. Names10names in public reportsHIDDEN COBRA · Guardians of Peace · Labyrinth Chollima
  3. Sectors6named as targetsFinancial institutions · Cryptocurrency · Entertainment
  4. Techniques14in the attack chainReconnaissance · Resource Development · Initial Access
  5. Tools10tools and malware listedAppleJeus · WannaCry · TraderTraitor

In one minute

Who they are
MITRE, Treasury and DOJ attribute Lazarus Group to the North Korean RGB. DOJ named three RGB members in an indictment dated 8 December 2020 and unsealed on 17 February 2021.
Who they target
Banks, cryptocurrency firms, entertainment companies, defense contractors and energy utilities in many countries, per the DOJ indictment. Crypto exchanges, DeFi services, games and large holders per CISA and the FBI.
How they usually get in
Spearphishing, often with a fake job offer or a fake trading app, per DOJ, CISA and the FBI.
What stands out
Governments say it steals money for the North Korean state, and that it has also run destructive attacks such as the 2014 Sony Pictures attack.
What to do first
Treat job offers you did not ask for and "trading tools" as hostile. Allow only apps from the vendor's own site, turn on multifactor authentication and disable Office macros.

Names

Public reports use several names for this activity.

Names used for Lazarus Group
NameWhere it appears
HIDDEN COBRA MITRE ATT&CK (Associated Groups); CISA AA21-048A, which uses it for North Korean malicious cyber activity[1, 9]
Guardians of Peace MITRE ATT&CK (Associated Groups)[1]
Labyrinth Chollima MITRE ATT&CK (Associated Groups)[1]
ZINC MITRE ATT&CK (Associated Groups)[1]
NICKEL ACADEMY MITRE ATT&CK (Associated Groups)[1]
Diamond Sleet MITRE ATT&CK (Associated Groups)[1]
APT38 DOJ indictment, EU Council Implementing Regulation 2020/1125 and CISA AA22-108A name it alongside Lazarus Group[2, 11, 8]
Bluenoroff Treasury press release of 13 Sep 2019 lists it as a separate group that worked with Lazarus Group; CISA AA22-108A lists it as another tracking name[3, 8]
Andariel Treasury press release of 13 Sep 2019 lists it as a third RGB-controlled group[3]
TraderTraitor FBI name for the crypto-theft activity behind Bybit, and CISA name for the malicious apps, in AA22-108A and the FBI notice of 26 Feb 2025[8, 10]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK page version 5.0, modified 31 Jul 2026

    Describes Lazarus Group as North Korean state-sponsored, attributed to the RGB, active since at least 2009[1]

  • US Treasury (OFAC) 2 Jan 2015

    Designated the RGB on 2 Jan 2015 after the Sony Pictures attack under Executive Order 13687[4]

  • US Treasury (OFAC) 13 Sep 2019

    Sanctioned Lazarus Group, Bluenoroff and Andariel and said all three are controlled by the RGB[3]

  • US Treasury (OFAC) 2 Mar 2020

    Sanctioned two people for laundering stolen cryptocurrency for Lazarus Group[5]

  • EU Council 30 Jul 2020

    Listed Chosun Expo for support to cyber-attacks including WannaCry; the listing links Chosun Expo to APT38 / Lazarus Group[11]

  • US Department of Justice indictment dated 8 Dec 2020, unsealed 17 Feb 2021

    Indictment says the three defendants were RGB members and that the conspirators included units known as Lazarus Group and APT38[2]

  • CISA, FBI and Treasury April 2021 (revision)

    Assess that Lazarus Group is attributed to North Korean state-sponsored APT actors and targets individuals and companies for cryptocurrency[9]

  • US Treasury (OFAC) 6 May 2022

    Says Lazarus Group carried out the Axie Infinity theft of almost $620 million[6]

  • FBI, CISA, Treasury 18 Apr 2022

    Joint advisory on a North Korean state-sponsored group stealing from blockchain firms since at least 2020[8, 14]

  • US Treasury (OFAC) 29 Nov 2023

    Sanctioned the Sinbad mixer as a laundering tool of Lazarus Group[7]

  • FBI 26 Feb 2025

    Says North Korea was responsible for the Bybit theft of about $1.5 billion, which it tracks as TraderTraitor[10]

  • Multilateral Sanctions Monitoring Team (11 states) 22 Oct 2025

    Joint statement on a report about DPRK cyber theft, IT workers and espionage by UN-designated entities including the RGB[13]

Where sources differ

Sources do not draw the group boundary in the same place. Treasury (13 September 2019) names Lazarus Group, Bluenoroff and Andariel as three groups controlled by the RGB and says Bluenoroff "worked jointly with" Lazarus Group on the Bangladesh Bank theft. The DOJ indictment (dated 8 December 2020) says RGB units "known within the cyber-security community as both Lazarus Group and Advanced Persistent Threat 38" were part of the conspiracy, so it treats the two names as one.

CISA's April 2022 TraderTraitor advisory lists Lazarus Group, APT38 and BlueNoroff as tracking names for one group active since at least 2020. The FBI's February 2025 notice uses the name TraderTraitor for the Bybit theft and does not use the name Lazarus Group. The WannaCry claim also differs in strength: DOJ alleges the hackers authored the ransomware for "WannaCry Version 2", while the EU Council listing is about support for the attacks and links Chosun Expo to APT38 / Lazarus Group. Treat the names as overlapping, not identical.

Who they target

Sectors

  • Financial institutionsDOJ lists "financial institutions" among victims and describes ATM cash-outs and the Bangladesh Bank theft.[2]
  • CryptocurrencyCISA lists exchanges, DeFi protocols, play-to-earn games, trading firms, venture funds and large holders.[8]
  • EntertainmentDOJ names Sony Pictures (attack from 24 Nov 2014) and AMC Theatres staff as spearphishing targets.[2]
  • DefenseDOJ lists "cleared defense contractors" among victims.[2]
  • EnergyDOJ lists energy utilities among victims.[2]
  • Online gamblingDOJ lists online casinos, including a Central American casino, as victims.[2]

Regions

  • United StatesDOJ says victims included the US and the Central District of California.[2]
  • South KoreaDOJ lists the Republic of Korea among countries of victims.[2]
  • Southeast and South AsiaDOJ lists Bangladesh, Indonesia, Pakistan, the Philippines and Vietnam.[2]
  • EuropeDOJ lists Malta, Poland, Slovenia and the United Kingdom.[2]
  • Latin AmericaDOJ lists Mexico and Central America.[2]
  • Over 30 countries (crypto)CISA says AppleJeus-type targeting reached organizations in over 30 countries in one year.[9]
  • TürkiyeCISA, the FBI and the US Treasury list Turkey among the countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. MITRE ATT&CK says Lazarus Group used the Bankshot implant in 2018 against the Turkish financial sector.[9, 15]
  • United KingdomOn 19 December 2017 the Foreign Office Minister attributed the WannaCry ransomware incident to the Lazarus Group. The release says WannaCry hit 300,000 computers in 150 countries, including 48 NHS trusts.[16]
  • GermanyThe advisory lists Germany among countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[9]
  • ItalyCISA, the FBI and the US Treasury list Italy among the countries where HIDDEN COBRA actors targeted organizations with AppleJeus malware since January 2020, in energy, finance, government, industry, technology and telecommunications.[9]
  • Saudi ArabiaThe advisory lists Saudi Arabia among countries where AppleJeus malware targeted energy, finance, government, industry, technology and telecommunications since January 2020.[9]
  • IndonesiaNames Indonesia in a list of nations whose financial institutions the BeagleBoyz team likely targeted from 2015 through 2020. The advisory says the team overlaps with Lazarus to varying degrees.[17]
  • IndiaNames India among countries targeted with AppleJeus malware since January 2020, in sectors including energy, finance and government. FBI, CISA and Treasury attribute Lazarus Group to North Korean state actors.[9]
  • SingaporeThe advisory lists Singapore among countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[9]
  • JapanThe NPA, FBI and DC3 said on 24 December 2024 that North Korean actors called TraderTraitor stole about 48.2 billion yen of crypto assets from the Japanese firm DMM Bitcoin in May 2024. The NPA says TraderTraitor is considered part of the Lazarus Group.[18]
  • TaiwanThe US Treasury said on 13 September 2019 that, according to press reports, Bluenoroff, a North Korean state-sponsored group it sanctioned with Lazarus Group, had carried out successful operations against banks in several countries including Taiwan.[3]
  • CanadaThe advisory lists Canada among countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[9]
  • AustraliaThe advisory lists Australia among the countries where AppleJeus malware was used against organizations since January 2020. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[9]
  • BrazilThe advisory lists Brazil among countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[9]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2009

    Earliest MITRE date

    MITRE says the group has been active since at least 2009.[1]

  2. 24 Nov 2014

    Sony Pictures attack

    DOJ alleges the hackers started a destructive attack on Sony Pictures after threatening staff. Treasury (2019) says Lazarus Group was responsible.[2, 3]

  3. 2 Jan 2015

    US designates the RGB

    Treasury designated the RGB after the Sony attack.[4]

  4. 4 Feb 2016

    Bangladesh Bank transfers

    DOJ alleges transfers of about $81 million to the Philippines and $20 million to Sri Lanka, with about $951 million attempted.[2]

  5. 2017

    WannaCry

    DOJ alleges the hackers authored the ransomware used in WannaCry Version 2 on or before 12 May 2017.[2]

  6. 24 Aug 2017

    Ransomware extortion

    DOJ alleges ransomware was deployed on a victim company, with about $100,000 in cryptocurrency extorted.[2]

  7. 2018

    Fake trading software

    DOJ alleges Celas Trade Pro, a fake crypto trading program, was developed from 2018.[2]

  8. 27 Oct 2018

    Pakistani bank ATM cash-out

    DOJ alleges about $6.1 million was dispensed after fake ATM approvals.[2]

  9. 13 Sep 2019

    Group sanctions

    Treasury sanctioned Lazarus Group, Bluenoroff and Andariel.[3]

  10. 30 Jul 2020

    EU lists Chosun Expo

    EU Council listed Chosun Expo for support of cyber-attacks including WannaCry.[11]

  11. 8 Dec 2020

    Indictment dated

    A federal indictment in Los Angeles charges three RGB members; it was unsealed 17 Feb 2021.[2]

  12. 23 Mar 2022

    Axie Infinity theft

    Treasury says Lazarus Group stole almost $620 million.[6]

  13. Apr 2022

    TraderTraitor advisory

    FBI, CISA and Treasury describe fake-job spearphishing against crypto firms.[8]

  14. 21 Feb 2025

    Bybit theft

    FBI says North Korea stole about $1.5 billion on or about this date.[10]

  15. 22 Oct 2025

    11-state statement

    Eleven governments describe ongoing DPRK cyber theft.[13]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about Lazarus Group
DateWhoWhat
2 Jan 2015 US Treasury Designation of the RGBDone under E.O. 13687 after the Sony Pictures attack.[4]
13 Sep 2019 US Treasury SanctionsLazarus Group, Bluenoroff and Andariel named as RGB-controlled.[3]
2 Mar 2020 US Treasury SanctionsTwo individuals designated for laundering cryptocurrency for Lazarus Group.[5]
30 Jul 2020 EU Council ListingChosun Expo listed for support of cyber-attacks, including WannaCry.[11]
8 Dec 2020 (unsealed 17 Feb 2021) US DOJ IndictmentJon Chang Hyok, Kim Il and Park Jin Hyok charged with conspiracy; DOJ alleges attempts to take more than $1.3 billion.[2]
Apr 2021 (revision) CISA, FBI, Treasury Advisory AA21-048AAppleJeus: fake crypto trading apps, with mitigations.[9]
18 Apr 2022 FBI, CISA, Treasury Advisory AA22-108ATraderTraitor: fake-job spearphishing of crypto staff.[8]
6 May 2022 US Treasury SanctionsBlender mixer sanctioned after the Axie Infinity theft.[6]
29 Nov 2023 US Treasury SanctionsSinbad mixer sanctioned as a Lazarus Group laundering tool.[7]
26 Feb 2025 FBI Public noticeNames North Korea for the Bybit theft and asks firms to block laundering addresses.[10]
22 Oct 2025 11 governments Joint statementStatement on a report covering DPRK cyber and IT worker activity.[13]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Search Open Websites/Domains: Social Media T1593.001

    MITRE records Operation Dream Job using LinkedIn to pick target staff.[1]

Resource Development

  • Establish Accounts: Social Media Accounts T1585.001

    MITRE records fake Twitter and LinkedIn accounts made for targeting.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE records malicious Word documents sent to victims.[1]

  • Phishing: Spearphishing via Service T1566.003

    MITRE records spearphishing through LinkedIn and Twitter.[1]

  • Drive-by Compromise T1189

    MITRE records RATANKBA delivered from a compromised legitimate website.[1]

Execution

  • User Execution: Malicious File T1204.002

    MITRE records attempts to get users to open malicious Word files; CISA lists the same technique for AppleJeus.[1, 9]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    MITRE records VBA macros in Word documents.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE records persistence through startup folders and Registry Run keys.[1]

Defense Evasion

  • Subvert Trust Controls: Code Signing T1553.002

    MITRE records signed malware and utilities to avoid detection.[1]

  • Hijack Execution Flow: DLL T1574.001

    MITRE records DLL side-loading through legitimate Windows programs.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE records C2 over HTTP and HTTPS; CISA lists it for AppleJeus.[1, 9]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    MITRE records Operation Dream Job using a custom build of an open-source command-line tool to send stolen data to Dropbox.[1]

Impact

  • Disk Wipe: Disk Structure Wipe T1561.002

    MITRE records SHARPKNOT overwriting the Master Boot Record, and says the group has possessed MBR wiper malware since at least 2009.[1]

  • Data Destruction T1485

    MITRE records a custom secure delete function that overwrites file contents.[1]

Tools and malware

  • AppleJeus Trojanized crypto trading app

    CISA describes apps that look like real trading software and carry malware to steal cryptocurrency.[1, 9]

  • WannaCry Ransomware

    DOJ alleges the hackers authored the ransomware used in WannaCry Version 2; MITRE lists it for the group.[2, 1]

  • TraderTraitor Trojanized Electron apps

    CISA's name for malicious crypto trading and price-prediction apps built with Node.js and Electron.[8]

  • Manuscrypt Remote access tool

    CISA lists updated macOS and Windows variants as payloads of TraderTraitor apps.[14]

  • Celas Trade Pro Fake trading software

    DOJ alleges it was a malicious cryptocurrency application developed from 2018.[2]

  • Torisma Custom malware

    MITRE lists it among custom malware the group developed.[1]

  • DRATzarus Custom malware

    MITRE lists it among custom malware the group developed, in Operation Dream Job.[1]

  • RATANKBA Remote access tool

    MITRE records it delivered through a compromised legitimate website.[1]

  • Responder Open tool

    MITRE records the group running Responder for credential harvesting.[1]

  • Dtrack Malware

    MITRE lists it as software used by the group.[1]

Also linked in our threat library:

Detection and defense

  1. Block fake job offers

    Train staff in system administration, DevOps and crypto roles to treat job offers they did not ask for and trading tools as hostile, and report them.

    Counters T1566.001 T1566.003 T1204.002

  2. Install apps from vendors only

    Download crypto and trading software only from the vendor's own site and check the source before install.

    Counters T1204.002 T1189

  3. Disable Office macros

    Turn off macros in Office products and block untrusted documents from the web.

    Counters T1059.005 T1566.001

  4. Use multifactor authentication

    Enforce MFA and strong credential rules, especially for exchange, wallet and admin accounts.

    Counters T1078 T1566.003

  5. Allowlist applications

    Use application allowlisting so unsigned or unknown programs, and DLLs side-loaded by Windows tools, do not run.

    Counters T1574.001 T1553.002 T1204.002

  6. Watch new domains and web traffic

    Scan email, block newly registered domains and use network detection for known malware traffic.

    Counters T1071.001 T1189

  7. Control startup and persistence

    Restrict who can add services, launch daemons and startup entries, and review them.

    Counters T1547.001

What Brandefense can do

  • Phishing Monitoring & Domain Abuse

    Find look-alike and newly registered domains that copy your brand, the kind of infrastructure the advisories describe behind fake trading apps and job lures.

  • Cyber Threat Intelligence

    Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.

  • Executive Protection

    Spot fake recruiter and executive profiles on professional networks, since MITRE records fake LinkedIn accounts used for targeting.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials that could let someone log in after a successful lure.

Questions

Who is Lazarus Group?

MITRE, Treasury and the US DOJ attribute the name to North Korean hacking units linked to the Reconnaissance General Bureau. Sources do not agree on exactly where the group boundary lies.

Are they still active?

The FBI said on 26 February 2025 that North Korea was responsible for the Bybit theft of about $1.5 billion, and 11 governments described ongoing DPRK cyber theft on 22 October 2025. The FBI used the name TraderTraitor, not Lazarus Group.

Who do they target?

The DOJ lists entertainment, finance, cryptocurrency, online casinos, defense contractors and energy utilities in many countries. CISA lists crypto exchanges, DeFi, games, trading firms and large holders.

How do they get in?

DOJ, CISA and the FBI describe spearphishing, often a recruitment lure or a trojanized trading app.

How can I tell if I am a target?

You are more exposed if you work in crypto or finance, or are an admin or developer there. Government advisories describe job offers that were not asked for, and trading tools, sent on chat platforms (CISA describes messages that mimic a recruitment effort).

What should I do first?

Train staff on fake job offers, enforce multifactor authentication, allow only apps from vendor sites and disable Office macros, as CISA advises. If hit, contact the FBI or CISA.

In our research

  1. ATT&CK techniques most used across threat groups October 2026
  2. Bybit theft: what it teaches about supplier access October 2026
  3. Tracking Threat Actors on Blockchain May 2026
  4. Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  5. Silent Chollima: North Korea’s Dual-Track Cyber Weapon December 2025
  6. TraderTraitor: North Korea’s Crypto Heist Machine December 2025
  7. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  8. The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025

Sources

  1. MITRE ATT&CK: Lazarus Group (G0032) MITRE Supports: Group description, associated names, techniques, software, Dream Job campaign
  2. United States of America v. Jon Chang Hyok, Kim Il, Park Jin Hyok (Indictment, CR 2:20-cr-00614-DMG) US District Court, Central District of California, via US DOJ Supports: RGB, Lazarus Group and APT38, $1.3 billion, Sony, Bangladesh Bank, WannaCry, ATM cash-outs, spearphishing
  3. Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups US Treasury Supports: 13 Sep 2019 sanctions on Lazarus Group, Bluenoroff and Andariel
  4. Treasury Imposes Sanctions Against the Government of The Democratic People's Republic Of Korea US Treasury Supports: 2 Jan 2015 RGB designation after Sony Pictures attack
  5. Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group US Treasury Supports: 2 Mar 2020 sanctions on launderers
  6. U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats US Treasury Supports: 6 May 2022 Blender and Axie Infinity theft
  7. Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency US Treasury Supports: 29 Nov 2023 Sinbad mixer and over $2 billion estimate
  8. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) CISA, FBI, Treasury Supports: Targets, spearphishing, mitigations
  9. AppleJeus: Analysis of North Korea's Cryptocurrency Malware (AA21-048A) CISA, FBI, Treasury Supports: Lazarus Group attribution, fake trading apps, over 30 countries, mitigations
  10. North Korea Responsible for $1.5 Billion Bybit Hack (PSA250226) FBI / IC3 Supports: Bybit attribution, TraderTraitor name
  11. Council Implementing Regulation (EU) 2020/1125 of 30 July 2020 (Official Journal L 246) Council of the EU Supports: Chosun Expo listing and link to APT38 / Lazarus Group
  12. Report of the Panel of Experts established pursuant to resolution 1874 (2009), S/2019/691 UN Security Council Supports: RGB direction of cyber actors, up to $2 billion, Bangladesh Bank spearphishing
  13. Joint Statement of the Multilateral Sanctions Monitoring Team (MSMT) on the Report Covering DPRK Cyber and IT Worker Activities UK Government, with 10 other states Supports: 22 Oct 2025 statement
  14. TraderTraitor advisory, full PDF (AA22-108A) CISA, FBI, Treasury Supports: Manuscrypt, Electron apps, MFA, allowlisting, macros advice
  15. Bankshot, Software S0239 MITRE ATT&CK Supports: 2018 use of the Bankshot implant against the Turkish financial sector
  16. Foreign Office Minister condemns North Korean actor for WannaCry attacks Foreign & Commonwealth Office (GOV.UK) Supports: Names United Kingdom as a target
  17. FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A) CISA Supports: Names Indonesia as a target
  18. Alert: Cyberattack by North Korean Cyber Actors, TraderTraitor National Police Agency, Japan Supports: Names Japan as a target

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Financial services

Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.

Read more

Role

CISO

See what is exposed outside your network in terms a board understands, and know what to do about it first.

Read more