Lazarus GroupThreat actor
- andariel
- appleworm
- apt 38
- apt-c-26
- APT38
- atk117
- atk3
- beagleboyz
- black artemis
- bureau 121
- copernicium
- covellite
- dark seoul
- dev-0139
- dev-1222
- diamond sleet
- g0032
- g0082
- group 77
- guardian of peace
- guardians of peace
- hastati group
- hidden cobra
- labyrinth chollima
- Lazarus
- moonstone sleet
- newromanic cyber army team
- nickel academy
- nickel gladstone
- onyx sleet
- operation applejeus
- operation darkseoul
- operation ghostsecret
- operation troy
- operationtroy
- plutonium
- Sapphire Sleet
- silent chollima
- Stardust Chollima
- storm-1789
- subgroup: andariel
- subgroup: bluenoroff
- ta404
- unit 121
- whois hacking team
- whois team
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek53 reports
ATT&CK techniques
6 of 111 · each with the sentence it comes from- T1684Social Engineering
“He added, “A vast percentage of social engineering, business email compromise, and credential harvesting attacks leverage lookalike or typo-squatted domains, tracking these external threats serves as a powerful indicator of an organization’s overall cyber hygiene and threat lands…”
- T1195Supply Chain Compromise
“According to the 2026 Unit 42 Global Incident Response Report, software supply chain compromises have become a leading initial access vector targeting enterprise cloud environments.”
- T1053.005Scheduled Task
“…to go beyond download events and hunt for suspicious browser activity, RunMRU registry key, WScript/PowerShell child processes, and scheduled tasks.”
- T1059Command and Scripting Interpreter
“ICS now also includes the Command and Scripting Interpreter Technique, with sub-techniques for six interpreters, replacing the deprecated Command-Line Interface and Scripting techniques.”
- T1553.002Code Signing
“The payload executed inside enterprise build pipelines to exfiltrate cloud tokens and target macOS code-signing certificates.”
- T1014Rootkit
“What arrived through the handshake was FudModule, Lazarus's kernel rootkit, in a build Check Point tracks as v3.1.It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows (ETW) providers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
53 reports · the newest 20, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“APT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.”
-
Operation FlashHole: Lazarus breaks security, defies control“Operation FlashHole: Lazarus breaks security, defies control”
-
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks“China-backed Salt Typhoon’s entry now covers its exploitation of network edge devices, while the entry for North Korea’s APT38 reflects a shift from financial theft to software supply chain attacks.”
-
Silent Push Says Impersonation Monitoring Belongs In Underwriting“The published examples span FIN7, Lazarus, PoisonSeed, FakeUpdate, Keitaro C2, and SecTopRAT.”
-
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware“…agnostics driver and the Bring-Your-Own-Vulnerable-Driver (BYOVD) target (CVE-2015-2291), abused by Scattered Spider, BlackByte, and Lazarus Group to disable EDR from kernel space.”
-
Evolution of Web3 in Cloud Supply Chain Attacks“This operational shift has been seen in North Korea-affiliated state-sponsored actors, such as Alluring Pisces (aka Sapphire Sleet or Midnight Neptune), that operationalize these techniques across their recent attributed supply chain campaigns, including those targeting Axios, Ma…”
-
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits“CrowdStrike, for its part, said it observed the North Korea-aligned Stardust Chollima (aka BlueNoroff) cluster likely targeting an employee at a financial services entity in July 2026 using a fake video conferencing site.”
-
August 2026 Threat Trend Report on APT Groups“Lazarus attacked defense industry targets in “Operation Dream Job” using a malicious PDF viewer and the CVE-2026-68820 zero-day vulnerability (a vulnerability exploited before it was publicly disclosed).”
-
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal“Lazarus top view: Kudelski and Sekoia researchers look at how the Lazarus Group is now operating from six distinct sub-clusters after a major reorganization of the North Korean intel service two years ago.”
-
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters“North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters”
-
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors“… and substitution ciphers and the watering-hole model already documented in the Operation Code on Toast (APT37) and Operation Synchole (Lazarus), allows medium confidence attribution to DPRK APT.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“Lazarus moves more crypto funds: Digital wallets associated with North Korea's Lazarus Group laundered more than $30 million worth of Bitcoin through the Hyperliquid platform over the past three weeks.”
-
North Korean Hackers Tied to Rust Supply Chain Attack“Microsoft and other threat intelligence teams track the threat actor behind these campaigns as Sapphire Sleet.”
-
July 2026 Threat Trend Report on APT Groups“APT38 (BlueNoroff) lured victims into fake Zoom and Microsoft Teams meetings using compromised Telegram accounts and executed Windows and macOS malware via ClickFix to steal cryptocurrency wallets and credentials.”
-
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day“Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day”
-
Six npm Packages Read C2 Addresses From Ethereum Wallet“…chnique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.”
-
NotPetya pulls BadRabbit out of the hat“Some time ago North Korean state sponsored hacker group – Lazarus also used avulnerability in this Web-server for targeted attacks on Banks.”
-
Targeted attacks on banks“According to investigation results, the attack was organized by Lazarus, a North Korean hacker group.”
-
LAZARUS ARISEN“The North Korean hacker group named Lazarus has spied on the ideological enemies of the regime – state institutions and private corporations in the United States and South Korea – for years.”
-
In a Risk Group“In October 2017 the North Korean Lazarus team, reaching the international system of interbank transfers, withdrew from the Far Eastern International Bank in Taiwan $60 million.”
Thanks — we review every report.