Log in Request a demo

Threat group profile

Lazarus Group

Also known as HIDDEN COBRA, Diamond Sleet, ZINC

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units.

In short

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units. They say these units work for the Reconnaissance General Bureau. The US charged three RGB members in 2020 and 2021 with attempts to steal or extort more than $1.3 billion. The FBI attributed the 2025 Bybit theft to North Korean actors it tracks as TraderTraitor.

Last updated 23 October 2026

Profile MapThreat Group
  1. Attributed OriginNorth Korea
  2. Names6names in public reportsHIDDEN COBRA · Guardians of Peace · Labyrinth Chollima
  3. Sectors7named as targetsFinancial institutions · Cryptocurrency · Entertainment
  4. Techniques14in the attack chainReconnaissance · Resource Development · Initial Access
  5. Tools12tools and malware listedAppleJeus · WannaCry · TraderTraitor

In one minute

Who they are
MITRE, Treasury and DOJ attribute Lazarus Group to the North Korean RGB. DOJ named three RGB members in an indictment dated 8 December 2020 and unsealed on 17 February 2021.
Who they target
Banks, cryptocurrency firms, entertainment companies, defense contractors and energy utilities in many countries, per the DOJ indictment. Crypto exchanges, DeFi services, games and large holders per CISA and the FBI.
How they usually get in
Spearphishing, often with a fake job offer or a fake trading app, per DOJ, CISA and the FBI.
What stands out
Governments say it steals money for the North Korean state. They say it has also run destructive attacks such as the 2014 Sony Pictures attack.
What to do first
Treat job offers you did not ask for and "trading tools" as hostile. Allow only apps from the vendor's own site. Turn on multifactor authentication and disable Office macros.

Names

Public reports use several names for this activity.

Names used for Lazarus Group
NameWhere it appears
HIDDEN COBRA MITRE ATT&CK (Associated Groups); CISA AA21-048A, which uses it for North Korean malicious cyber activity[1, 5]
Guardians of Peace MITRE ATT&CK (Associated Groups)[1]
Labyrinth Chollima MITRE ATT&CK (Associated Groups)[1]
ZINC MITRE ATT&CK (Associated Groups)[1]
NICKEL ACADEMY MITRE ATT&CK (Associated Groups)[1]
Diamond Sleet MITRE ATT&CK (Associated Groups)[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK page version 5.0, modified 31 Jul 2026

    Describes Lazarus Group as North Korean state-sponsored, attributed to the RGB, active since at least 2009[1]

  • US Treasury (OFAC) 2 Jan 2015

    Designated the RGB on 2 Jan 2015 after the Sony Pictures attack under Executive Order 13687

  • US Treasury (OFAC) 13 Sep 2019

    Sanctioned Lazarus Group, Bluenoroff and Andariel and said all three are controlled by the RGB[3]

  • US Treasury (OFAC) 2 Mar 2020

    Sanctioned two people for laundering stolen cryptocurrency for Lazarus Group

  • EU Council 30 Jul 2020

    Listed Chosun Expo for support to cyber-attacks including WannaCry; the listing links Chosun Expo to APT38 / Lazarus Group[7]

  • US Department of Justice indictment dated 8 Dec 2020, unsealed 17 Feb 2021

    Indictment says the three defendants were RGB members and that the conspirators included units known as Lazarus Group and APT38[2]

  • CISA, FBI and Treasury April 2021 (revision)

    Assess that Lazarus Group is attributed to North Korean state-sponsored APT actors and targets individuals and companies for cryptocurrency[5]

  • US Treasury (OFAC) 6 May 2022

    Says Lazarus Group carried out the Axie Infinity theft of almost $620 million

  • FBI, CISA, Treasury 18 Apr 2022

    Joint advisory on a North Korean state-sponsored group stealing from blockchain firms since at least 2020[4]

  • US Treasury (OFAC) 29 Nov 2023

    Sanctioned the Sinbad mixer as a laundering tool of Lazarus Group

  • FBI 26 Feb 2025

    Says North Korea was responsible for the Bybit theft of about $1.5 billion, which it tracks as TraderTraitor[6]

  • Multilateral Sanctions Monitoring Team (11 states) 22 Oct 2025

    Joint statement on a report about DPRK cyber theft, IT workers and espionage by UN-designated entities including the RGB (per UK Government, with 10 other states)

  • Kaspersky 21 Oct 2026

    Ties Operation FlashHole to the Lazarus Group. It also says, with medium-to-high confidence, that the same actor ran Operation SyncHole.[8]

Where sources differ

Sources do not draw the group boundary in the same place. Treasury (13 September 2019) names Lazarus Group, Bluenoroff and Andariel as three groups controlled by the RGB. It says Bluenoroff "worked jointly with" Lazarus Group on the Bangladesh Bank theft.

The DOJ indictment (dated 8 December 2020) says RGB units "known within the cyber-security community as both Lazarus Group and Advanced Persistent Threat 38" were part of the conspiracy. So it treats the two names as one.

CISA's April 2022 TraderTraitor advisory lists Lazarus Group, APT38 and BlueNoroff as tracking names for one group active since at least 2020. The FBI's February 2025 notice uses the name TraderTraitor for the Bybit theft. It does not use the name Lazarus Group.

The WannaCry claim also differs in strength. DOJ alleges the hackers authored the ransomware for "WannaCry Version 2". The EU Council listing is about support for the attacks and links Chosun Expo to APT38 / Lazarus Group. Treat the names as overlapping, not identical.

Who they target

Sectors

  • Financial institutionsDOJ lists "financial institutions" among victims. It describes ATM cash-outs and the Bangladesh Bank theft.[2]
  • CryptocurrencyCISA lists exchanges, DeFi protocols, play-to-earn games, trading firms, venture funds and large holders.[4]
  • EntertainmentDOJ names Sony Pictures (attack from 24 Nov 2014) and AMC Theatres staff as spearphishing targets.[2]
  • DefenseDOJ lists "cleared defense contractors" among victims.[2]
  • EnergyDOJ lists energy utilities among victims.[2]
  • Online gamblingDOJ lists online casinos, including a Central American casino, as victims.[2]
  • Software, construction and communication equipment (South Korea)Kaspersky reports at least three South Korean firms in these sectors hit in Operation FlashHole. It believes there were more.[8]

Regions

  • United StatesDOJ says victims included the US and the Central District of California.[2]
  • South KoreaDOJ lists the Republic of Korea among countries of victims.[2]
  • Southeast and South AsiaDOJ lists Bangladesh, Indonesia, Pakistan, the Philippines and Vietnam.[2]
  • EuropeDOJ lists Malta, Poland, Slovenia and the United Kingdom.[2]
  • Latin AmericaDOJ lists Mexico and Central America.[2]
  • Over 30 countries (crypto)CISA says AppleJeus-type targeting reached organizations in over 30 countries in one year.[5]
  • TürkiyeCISA, the FBI and the US Treasury list Turkey among the countries where AppleJeus malware was used against organizations since January 2020. The sectors include energy, finance, government, industry, technology and telecommunications. MITRE ATT&CK says Lazarus Group used the Bankshot implant in 2018 against the Turkish financial sector.[5]
  • United KingdomOn 19 December 2017 the Foreign Office Minister attributed the WannaCry ransomware incident to the Lazarus Group. The release says WannaCry hit 300,000 computers in 150 countries, including 48 NHS trusts.
  • GermanyThe advisory lists Germany among countries where AppleJeus malware was used against organizations since January 2020. The sectors include energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[5]
  • ItalyCISA, the FBI and the US Treasury list Italy among the countries where HIDDEN COBRA actors targeted organizations with AppleJeus malware since January 2020. The sectors are energy, finance, government, industry, technology and telecommunications.[5]
  • Saudi ArabiaThe advisory lists Saudi Arabia among countries where AppleJeus malware was used since January 2020. It targeted energy, finance, government, industry, technology and telecommunications.[5]
  • IndonesiaNames Indonesia in a list of nations whose financial institutions the BeagleBoyz team likely targeted from 2015 through 2020. The advisory says the team overlaps with Lazarus to varying degrees (per CISA).
  • IndiaNames India among countries targeted with AppleJeus malware since January 2020, in sectors including energy, finance and government. FBI, CISA and Treasury attribute Lazarus Group to North Korean state actors.[5]
  • SingaporeThe advisory lists Singapore among countries where AppleJeus malware was used against organizations since January 2020. The sectors include energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[5]
  • JapanThe NPA, FBI and DC3 said on 24 December 2024 that North Korean actors called TraderTraitor stole about 48.2 billion yen of crypto assets. The victim was the Japanese firm DMM Bitcoin, in May 2024. The NPA says TraderTraitor is considered part of the Lazarus Group (per National Police Agency).
  • TaiwanThe US Treasury said on 13 September 2019 that, according to press reports, Bluenoroff had carried out successful operations against banks in several countries including Taiwan. Treasury describes Bluenoroff as a North Korean state-sponsored group that it sanctioned with Lazarus Group.[3]
  • CanadaThe advisory lists Canada among countries where AppleJeus malware was used against organizations since January 2020. The sectors include energy, finance and government. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[5]
  • AustraliaThe advisory lists Australia among the countries where AppleJeus malware was used against organizations since January 2020. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[5]
  • BrazilThe advisory lists Brazil among countries where AppleJeus malware was used against organizations since January 2020. The sectors include energy, finance, government, industry, technology and telecommunications. The agencies attribute Lazarus Group to North Korean state-sponsored actors.[5]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2009

    Earliest MITRE date

    MITRE says the group has been active since at least 2009.[1]

  2. 24 Nov 2014

    Sony Pictures attack

    DOJ alleges the hackers threatened staff. It alleges they then started a destructive attack on Sony Pictures. Treasury (2019) says Lazarus Group was responsible.[2, 3]

  3. 2 Jan 2015

    US designates the RGB

    Treasury designated the RGB after the Sony attack.

  4. 4 Feb 2016

    Bangladesh Bank transfers

    DOJ alleges transfers of about $81 million to the Philippines and $20 million to Sri Lanka. It alleges about $951 million was attempted.[2]

  5. 2017

    WannaCry

    DOJ alleges the hackers authored the ransomware used in WannaCry Version 2 on or before 12 May 2017.[2]

  6. 24 Aug 2017

    Ransomware extortion

    DOJ alleges ransomware was deployed on a victim company. It alleges about $100,000 in cryptocurrency was extorted.[2]

  7. 2018

    Fake trading software

    DOJ alleges Celas Trade Pro, a fake crypto trading program, was developed from 2018.[2]

  8. 27 Oct 2018

    Pakistani bank ATM cash-out

    DOJ alleges about $6.1 million was dispensed after fake ATM approvals.[2]

  9. 13 Sep 2019

    Group sanctions

    Treasury sanctioned Lazarus Group, Bluenoroff and Andariel.[3]

  10. 30 Jul 2020

    EU lists Chosun Expo

    EU Council listed Chosun Expo for support of cyber-attacks including WannaCry.[7]

  11. 8 Dec 2020

    Indictment dated

    A federal indictment in Los Angeles charges three RGB members; it was unsealed 17 Feb 2021.[2]

  12. 23 Mar 2022

    Axie Infinity theft

    Treasury says Lazarus Group stole almost $620 million.

  13. Apr 2022

    TraderTraitor advisory

    FBI, CISA and Treasury describe fake-job spearphishing against crypto firms.[4]

  14. 21 Feb 2025

    Bybit theft

    FBI says North Korea stole about $1.5 billion on or about this date.[6]

  15. 22 Oct 2025

    11-state statement

    Eleven governments describe ongoing DPRK cyber theft (per UK Government, with 10 other states).

  16. 21 Oct 2026

    Kaspersky reports Operation FlashHole

    Kaspersky ties an espionage operation in South Korea to Lazarus. It hit software, construction and communication equipment firms. The earliest evidence dates to July 2025. Kaspersky says the LPEClient tool used ML-KEM-1024, a post-quantum key exchange, to hide the payloads it downloads.[8]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about Lazarus Group
DateWhoWhat
2 Jan 2015 US Treasury Designation of the RGBDone under E.O. 13687 after the Sony Pictures attack.
13 Sep 2019 US Treasury SanctionsLazarus Group, Bluenoroff and Andariel named as RGB-controlled.[3]
2 Mar 2020 US Treasury SanctionsTwo individuals designated for laundering cryptocurrency for Lazarus Group.
30 Jul 2020 EU Council ListingChosun Expo listed for support of cyber-attacks, including WannaCry.[7]
8 Dec 2020 (unsealed 17 Feb 2021) US DOJ IndictmentJon Chang Hyok, Kim Il and Park Jin Hyok charged with conspiracy; DOJ alleges attempts to take more than $1.3 billion.[2]
Apr 2021 (revision) CISA, FBI, Treasury Advisory AA21-048AAppleJeus: fake crypto trading apps, with mitigations.[5]
18 Apr 2022 FBI, CISA, Treasury Advisory AA22-108ATraderTraitor: fake-job spearphishing of crypto staff.[4]
6 May 2022 US Treasury SanctionsBlender mixer sanctioned after the Axie Infinity theft.
29 Nov 2023 US Treasury SanctionsSinbad mixer sanctioned as a Lazarus Group laundering tool.
26 Feb 2025 FBI Public noticeNames North Korea for the Bybit theft. Asks firms to block laundering addresses.[6]
22 Oct 2025 11 governments Joint statement (per UK Government, with 10 other states)Statement on a report covering DPRK cyber and IT worker activity.

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Search Open Websites/Domains: Social Media T1593.001

    MITRE records Operation Dream Job using LinkedIn to pick target staff.[1]

Resource Development

  • Establish Accounts: Social Media Accounts T1585.001

    MITRE records fake Twitter and LinkedIn accounts made for targeting.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE records malicious Word documents sent to victims.[1]

  • Phishing: Spearphishing via Service T1566.003

    MITRE records spearphishing through LinkedIn and Twitter.[1]

  • Drive-by Compromise T1189

    MITRE records RATANKBA delivered from a compromised legitimate website.[1]

Execution

  • User Execution: Malicious File T1204.002

    MITRE records attempts to get users to open malicious Word files. CISA lists the same technique for AppleJeus.[1, 5]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    MITRE records VBA macros in Word documents.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE records persistence through startup folders and Registry Run keys.[1]

Defense Evasion

  • Subvert Trust Controls: Code Signing T1553.002

    MITRE records signed malware and utilities to avoid detection.[1]

  • Hijack Execution Flow: DLL T1574.001

    MITRE records DLL side-loading through legitimate Windows programs.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE records C2 over HTTP and HTTPS; CISA lists it for AppleJeus.[1, 5]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    MITRE records Operation Dream Job using a custom build of an open-source command-line tool. It was used to send stolen data to Dropbox.[1]

Impact

  • Disk Wipe: Disk Structure Wipe T1561.002

    MITRE records SHARPKNOT overwriting the Master Boot Record. It says the group has possessed MBR wiper malware since at least 2009.[1]

  • Data Destruction T1485

    MITRE records a custom secure delete function that overwrites file contents.[1]

Tools and malware

  • AppleJeus Trojanized crypto trading app

    CISA describes apps that look like real trading software. They carry malware to steal cryptocurrency.[1, 5]

  • WannaCry Ransomware

    DOJ alleges the hackers authored the ransomware used in WannaCry Version 2. MITRE lists it for the group.[2, 1]

  • TraderTraitor Trojanized Electron apps

    CISA's name for malicious crypto trading and price-prediction apps built with Node.js and Electron.[4]

  • Manuscrypt Remote access tool

    CISA lists updated macOS and Windows variants as payloads of TraderTraitor apps (per CISA, FBI, Treasury).

  • Celas Trade Pro Fake trading software

    DOJ alleges it was a malicious cryptocurrency application developed from 2018.[2]

  • Torisma Custom malware

    MITRE lists it among custom malware the group developed.[1]

  • DRATzarus Custom malware

    MITRE lists it among custom malware the group developed, in Operation Dream Job.[1]

  • RATANKBA Remote access tool

    MITRE records it delivered through a compromised legitimate website.[1]

  • Responder Open tool

    MITRE records the group running Responder for credential harvesting.[1]

  • Dtrack Malware

    MITRE lists it as software used by the group.[1]

  • LPEClient Profiler and payload loader

    Kaspersky says it profiles the host and loads payloads into memory. It uses ML-KEM-1024 for its key exchange. It was also seen in Operation SyncHole.[8]

  • TechHub Downloader

    Kaspersky says it talks to private GitHub repositories. It is a newer version of the tool Mandiant calls CLOUDBURST and ESET calls NickelLoader.[8]

Also linked in our threat library:

Detection and defense

  1. Block fake job offers

    Train staff in system administration, DevOps and crypto roles to treat job offers they did not ask for and trading tools as hostile. Ask them to report these.

    Counters T1566.001 T1566.003 T1204.002

  2. Install apps from vendors only

    Download crypto and trading software only from the vendor's own site. Check the source before install.

    Counters T1204.002 T1189

  3. Disable Office macros

    Turn off macros in Office products and block untrusted documents from the web.

    Counters T1059.005 T1566.001

  4. Use multifactor authentication

    Enforce MFA and strong credential rules, especially for exchange, wallet and admin accounts.

    Counters T1078 T1566.003

  5. Allowlist applications

    Use application allowlisting. This way unsigned or unknown programs, and DLLs side-loaded by Windows tools, do not run.

    Counters T1574.001 T1553.002 T1204.002

  6. Watch new domains and web traffic

    Scan email and block newly registered domains. Use network detection for known malware traffic.

    Counters T1071.001 T1189

  7. Control startup and persistence

    Restrict who can add services, launch daemons and startup entries. Review them as well.

    Counters T1547.001

What Brandefense can do

  • Phishing Monitoring & Domain Abuse

    Find look-alike and newly registered domains that copy your brand. The advisories describe this kind of infrastructure behind fake trading apps and job lures.

  • Cyber Threat Intelligence

    Follow what governments and MITRE report about this group. Then compare its listed techniques with your own controls.

  • Executive Protection

    Spot fake recruiter and executive profiles on professional networks. MITRE records fake LinkedIn accounts used for targeting.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials. They could let someone log in after a successful lure.

Questions

Who is Lazarus Group?

MITRE, Treasury and the US DOJ attribute the name to North Korean hacking units linked to the Reconnaissance General Bureau. Sources do not agree on exactly where the group boundary lies.

Are they still active?

The FBI said on 26 February 2025 that North Korea was responsible for the Bybit theft of about $1.5 billion. On 22 October 2025, 11 governments described ongoing DPRK cyber theft. The FBI used the name TraderTraitor, not Lazarus Group. Kaspersky reported on 21 October 2026 that Operation FlashHole, which it ties to Lazarus, hit at least three South Korean organizations, with first evidence in July 2025.

Who do they target?

The DOJ lists entertainment, finance, cryptocurrency, online casinos, defense contractors and energy utilities in many countries. CISA lists crypto exchanges, DeFi, games, trading firms and large holders.

How do they get in?

DOJ, CISA and the FBI describe spearphishing, often a recruitment lure or a trojanized trading app.

How can I tell if I am a target?

You are more exposed if you work in crypto or finance. The same is true if you are an admin or developer there. Government advisories describe job offers that were not asked for, and trading tools, sent on chat platforms. CISA describes messages that mimic a recruitment effort.

What should I do first?

CISA advises these steps. Train staff on fake job offers, enforce multifactor authentication, allow only apps from vendor sites and disable Office macros. If hit, contact the FBI or CISA.

In our research

  1. North Korea AI Hacking: What Microsoft Documented Across Eight Groups October 2026
  2. Binance Hack on Telegram and X: Guesses in Minutes, a Name in Hours October 2026
  3. Binance Security Incident: $6.3B Impact, Withdrawals Paused October 2026
  4. Kaspersky: Lazarus Hides Malware Payloads With Post-Quantum Encryption in Operation FlashHole October 2026
  5. ATT&CK techniques most used across threat groups October 2026
  6. Post-quantum migration milestones: NCSC and EU dates October 2026
  7. Post-quantum cryptography: NIST and CISA guidance in 2026 October 2026
  8. Bybit theft: what it teaches about supplier access October 2026

Sources

  1. MITRE ATT&CK: Lazarus Group (G0032) MITRE Supports: Group description, associated names, techniques, software, Dream Job campaign
  2. United States of America v. Jon Chang Hyok, Kim Il, Park Jin Hyok (Indictment, CR 2:20-cr-00614-DMG) US District Court, Central District of California, via US DOJ Supports: RGB, Lazarus Group and APT38, $1.3 billion, Sony, Bangladesh Bank, WannaCry, ATM cash-outs, spearphishing
  3. Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups US Treasury Supports: 13 Sep 2019 sanctions on Lazarus Group, Bluenoroff and Andariel
  4. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) CISA, FBI, Treasury Supports: Targets, spearphishing, mitigations
  5. AppleJeus: Analysis of North Korea's Cryptocurrency Malware (AA21-048A) CISA, FBI, Treasury Supports: Lazarus Group attribution, fake trading apps, over 30 countries, mitigations
  6. North Korea Responsible for $1.5 Billion Bybit Hack (PSA250226) FBI / IC3 Supports: Bybit attribution, TraderTraitor name
  7. Council Implementing Regulation (EU) 2020/1125 of 30 July 2020 (Official Journal L 246) Council of the EU Supports: Chosun Expo listing and link to APT38 / Lazarus Group
  8. Operation FlashHole: Lazarus breaks security, defies control Kaspersky Securelist Supports: FlashHole victims, infection chain, LPEClient and ML-KEM-1024, attribution and links to SyncHole

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Financial services

Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.

Read more

Role

CISO

See what is exposed outside your network in terms a board understands, and know what to do about it first.

Read more

Article

Tracking Threat Actors on Blockchain

Blockchain threat actor tracking follows public ledger records to show how attackers move funds. See what the Brandefense report covers and why it matters.

Read more