Sign inStart freeBook a demo

Lazarus Group threat group

Lazarus Group is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 80 attack techniques, and to attacks on government and private sector organisations, with 18 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Start free →Book a demo
ShareXLinkedIn
Attack techniques
80
Countries and victims named
18
Thought to operate from
North Korea
Suspected backing
North Korea
Other names
38
Built from public reporting, with every source listed below.
Overview

Who is Lazarus Group?

Lazarus Group has 38 other names in security research. Below is what published reporting says about it, with a link to every report so you can check the detail yourself.

Also known as

Operation DarkSeoulDark SeoulHidden CobraHastati GroupAndarielUnit 121Bureau 121NewRomanic Cyber Army TeamBluenoroffSubgroup: BluenoroffGroup 77Labyrinth Chollima

Security companies each give the same group their own name, so one group can have many.

What public reporting says

Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

Public reports about Lazarus Group (67)

How it works

How does Lazarus Group attack? Stage by stage.

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 80 linked to Lazarus Group, laid out from first look to final blow. Some techniques belong to more than one stage. Pick a stage to see them. Public reporting also lists 77 more specific variations of them, called sub-techniques.

Stage 7 of 15

Hiding

Disguising what they are doing so it blends in with normal activity.

18 techniques
  • T1027Obfuscated Files or Information
  • T1036Masquerading
  • T1055Process Injection
  • T1070Indicator Removal
  • T1078Valid Accounts
  • T1134Access Token Manipulation
  • T1140Deobfuscate/Decode Files or Information
  • T1202Indirect Command Execution
  • T1218System Binary Proxy Execution
  • T1220XSL Script Processing
  • T1221Template Injection
  • T1497Virtualization/Sandbox Evasion
  • T1542Pre-OS Boot
  • T1564Hide Artifacts
  • T1574Hijack Execution Flow
  • T1620Reflective Code Loading
  • T1622Debugger Evasion
  • T1684Social Engineering
Targets

Who does Lazarus Group go after?

The sectors and places named in public reporting about this group. If yours is on the list, it is worth knowing how they work and which flaws they use.

Sectors (2)

GovernmentPrivate sector
See threats by industry →

Countries and victims named (18)

  1. 01South Korea
  2. 02Bangladesh Bank
  3. 03Sony Pictures Entertainment
  4. 04United States
  5. 05Thailand
  6. 06France
  7. 07China
  8. 08Hong Kong
  9. 09United Kingdom
  10. 10Guatemala
  11. 11Canada
  12. 12Bangladesh
  13. 13Japan
  14. 14India
  15. 15Germany
  16. 16Brazil
  17. 17Australia
  18. 18Cryptocurrency exchanges in South Korea
Free account

Is Lazarus Group a risk to you?

A public profile tells you who a group is. Your account tells you whether it matters to you: we match the software you run to the flaws threat groups use, and we keep watching, so you hear about anything that affects you as soon as we know.

  • Over 900 group profiles in the app, every claim backed by a quote and a source link.
  • Your sector at a glance: which threat groups and ransomware gangs are hitting it.
  • Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
  • A PDF dossier on any group, ready to send to your board or your IT provider.
Start free →Book a demo
FAQ

Questions about Lazarus Group

Something else? Talk to the team →

Lazarus Group is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 80 attack techniques, and to attacks on government and private sector organisations, with 18 countries and victims named.

Public reporting places Lazarus Group as operating from North Korea, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

In public reporting, sectors named include government and private sector, and 18 countries and victims are named, including South Korea, Bangladesh Bank, Sony Pictures Entertainment and United States.

Public reporting links Lazarus Group to 80 attack techniques. Most of them are about hiding, looking around and keeping contact with their servers.

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

Get started

Find out what groups like this could use against you.

Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.

Start free →Book a demo

No card neededNothing to installIntelligence and alerts free