Lazarus Group

Also known as: Hidden Cobra, ZINC, Diamond Sleet, APT38

Overview

North Korean state-sponsored group focused on financial theft and crypto heists to fund the regime. Also conducts espionage and destructive attacks. Responsible for $1.5B Bybit hack.

MITRE ATT&CK Coverage

Recon
Res Dev
Init Access
Execution
Persistence
Priv Esc
Def Evasion
Cred Access
Discovery
Lat Move
Collection
C2
Exfil
Impact
3 of 14 tactics observed

Raw TTPs

Cryptocurrency TheftSupply Chain AttacksSocial EngineeringWatering HoleCustom MalwareDeFi Exploitation

Related Intelligence (2)

HIGHRansomware

North Korea’s APT Capabilities Are No Longer State-Exclusive

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/north-koreas-apt-capabilities-are-no-longer-state-exclusive-image_small-9-a-32392.jpg" align=right hspace=4><b>AhnLab Found Shared Malware, SSH Keys and Infrastructure Across Two Campaigns</b><br>Shared malware, infrastructure and access methods link Lazarus Group to Gunra ransomware activity, while former North Korean military ha

Bank Info Security
HIGHRansomware

North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn

Cyberattack tools and infrastructure used by North Korea’s Lazarus Group appear to have been shared with ransomware criminals targeting South Korean organizations — further evidence of deepening entanglement between Pyongyang-backed hackers and the ransomware ecosystem.

The Record