ThreatRoundup

Lazarus Group (Diamond Sleet)

North Korean RGB-linked group behind Sony, WannaCry and billions in crypto theft, mixing espionage, sabotage and fake job offers aimed at defense and tech staff.

Threat actor profile · Updated

Active
2009 to October 2026
Origin
North Korea
Type
State-sponsored
Affiliates
Reconnaissance General Bureau (RGB), TraderTraitor, Bluenoroff, APT38, Andariel (Stonefly), Kimsuky (overlap as reported)
Regions targeted
South Korea, United States, Europe, Bangladesh, Middle East, global cryptocurrency sector
MITRE ATT&CK
G0032

What each vendor calls it

Microsoft
DEV-0139DEV-1222Diamond SleetZINC
CrowdStrike
Labyrinth Chollima
Sophos / Secureworks
NICKEL ACADEMY
Proofpoint
TA404

Also known as ApplewormAPT-C-26 Qihoo 360ATK117ATK3Black ArtemisBureau 121COVELLITEDark SeoulGroup 77Guardians of Peace US governmentHastati GroupHIDDEN COBRA US governmentLazarusNewRomanic Cyber Army TeamOperation AppleJeusOperation DarkSeoulOperation GhostSecretSubgroup: BluenoroffUnit 121Whois Hacking Team

See this actor in the Threat Actor Rosetta Stone →

Profile

Lazarus Group is North Korea’s best-known hacking outfit and one of the most prolific state actors anywhere. MITRE ATT&CK describes it as a state-sponsored group attributed to the Reconnaissance General Bureau (RGB), North Korea’s main intelligence agency, active since at least 2009. The US government has made that link formally: in September 2019 the Treasury Department sanctioned Lazarus Group, together with Bluenoroff and Andariel, as entities controlled by the RGB, and in February 2021 the Justice Department indicted three RGB military hackers over a scheme that ran from the Sony Pictures attack to bank and cryptocurrency theft.

One caution before the details. MITRE notes that public reporting often uses “Lazarus” as an umbrella for several North Korean teams that share people, infrastructure and malware. MITRE itself tracks the bank-heist operation (APT38), Andariel and Kimsuky as separate groups, and the FBI has repeatedly written “Lazarus Group (also known as APT38)” when naming who stole a given batch of cryptocurrency. This profile follows MITRE’s Lazarus scope and flags where a source assigns an operation to a sibling or sub-group.

The mission is mixed, and that’s what makes Lazarus unusual. It does classic espionage against defense, aerospace and technology companies; it has run destructive attacks (the November 2014 Sony Pictures wiper, which the FBI pinned on the North Korean government, and the 2017 WannaCry outbreak, both charged in a 2018 Justice Department complaint); and it steals money for a sanctioned regime on a scale no criminal gang matches. The FBI has attributed to Lazarus the $620 million Ronin bridge theft in 2022, the $100 million Harmony Horizon theft and the $41 million Stake.com theft, and in February 2025 it blamed the North Korean activity it calls TraderTraitor for the $1.5 billion Bybit heist. CISA’s 2022 TraderTraitor advisory ties that name to Lazarus.

Social engineering is the signature move. Under the long-running Operation Dream Job banner, operators pose as recruiters on LinkedIn and other platforms, send fake job offers or coding tests, and deliver trojanized PDF readers or open-source tools. ESET documented a 2025 wave aimed at European defense firms working on drones, and its October 2026 activity report says Lazarus resumed that drone-sector targeting this year. In 2021 Google TAG and Microsoft caught the group befriending security researchers with fake research blogs and a backdoored Visual Studio project, a brazen way to steal other people’s vulnerability work.

The group also exploits software, often quickly and sometimes with zero-days. Avast and Gen caught it using two Windows kernel zero-days in 2024 (CVE-2024-21338 and CVE-2024-38193) to load its FudModule rootkit, which blinds security tools from inside the kernel, and Kaspersky found a Chrome zero-day (CVE-2024-4947) hidden behind a fake blockchain tank game. On the n-day side, Microsoft saw Diamond Sleet (its name for the group) hitting JetBrains TeamCity build servers within weeks of disclosure, and Cisco Talos tracked it through ManageEngine and Log4Shell. Supply-chain compromise is a recurring theme too, from a tampered CyberLink installer to South Korean banking and file-transfer plug-ins.

South Korea gets special attention. Kaspersky’s Operation SyncHole (November 2024 to February 2025) combined watering-hole sites with flaws in Korean software to breach at least six firms, and ThreatRoundup covered Kaspersky’s follow-up in October 2026, Operation FlashHole, in which the mandatory INISAFE CrossWeb EX plug-in launched Lazarus shellcode at three more companies. One of the tools in that chain now swaps keys with the post-quantum ML-KEM-1024 algorithm, a first for the group.

Two newer shifts are worth watching. In February 2026 Symantec reported Lazarus attackers deploying Medusa ransomware, including an attempted attack on a US healthcare provider, so the regime’s hackers are now renting criminal ransomware rather than only building their own. And attribution of the biggest thefts increasingly comes from victims and blockchain firms before governments: LayerZero’s preliminary blame of Lazarus for the April 2026 KelpDAO theft is one example. Even the suspicion is now a signal: in October 2026 CYFIRMA linked a slow, quiet PHP2Shell scanning campaign to the Lazarus ecosystem with only moderate confidence, resting on language and past tradecraft.

Naming is messy. Microsoft calls the group Diamond Sleet (formerly ZINC), CrowdStrike Labyrinth Chollima, Secureworks NICKEL ACADEMY, Proofpoint TA404, and the US government HIDDEN COBRA (full list above).

Events

Date Target Narrative Source Our coverage
2026-10 Government, banking, manufacturing, shipping and aviation PHP servers in the US, Asia-Pacific, the Gulf and the EU CYFIRMA reports Korean-speaking operators quietly scanning 216 unpatched PHP hosts for the PHP2Shell flaws, using T1190 (Exploit Public-Facing Application) and web shells. It rates a Lazarus link only moderate, offers a non-state Korean-speaking crew as an alternative, and confirms no compromises. CYFIRMA Our story
2025-07 to 2026-10 At least three South Korean software, construction and communications-equipment firms Operation FlashHole: fake résumé and portfolio sites on GitHub Pages, then the INISAFE CrossWeb EX service spawns a process injected with Lazarus shellcode. Later stages take orders through GitHub issues, T1102.002 (Web Service: Bidirectional Communication), and side-load a fake mscoree.dll, T1574.001 (Hijack Execution Flow: DLL). Kaspersky Our story
2026-04 KelpDAO cross-chain bridge About $290 million in rsETH stolen after attackers poisoned the RPC nodes feeding the bridge’s verifier and knocked healthy nodes offline with DDoS. LayerZero calls Lazarus, specifically TraderTraitor, the likely culprit on preliminary indicators. BleepingComputer
2026-02 Middle East organization; US healthcare provider Symantec finds North Korean attackers using Medusa ransomware alongside the Lazarus-only Comebacker loader and the Blindingcan RAT; the US healthcare attack failed. Symantec points to the Lazarus sub-group Stonefly (Andariel) as the main driver of North Korean extortion. Symantec
2025-03 onward Three defense and aerospace companies in Central and Southeastern Europe, some building drones New Operation Dream Job wave: fake job offers and trojanized open-source projects from GitHub deliver the ScoringMathTea RAT, likely to steal drone design and manufacturing know-how. ESET
2024-11 to 2025-02 At least six South Korean software, IT, finance, semiconductor and telecom firms Operation SyncHole: watering-hole sites, T1189 (Drive-by Compromise), combined with flaws in Cross EX and a one-day bug in Innorix Agent for lateral movement; ThreatNeedle, wAgent, SIGNBT and COPPERHEDGE deployed. Kaspersky
2025-02 Bybit cryptocurrency exchange About $1.5 billion in virtual assets stolen on or around Feb. 21. The FBI attributes it to North Korea’s TraderTraitor activity and tracks rapid laundering across thousands of addresses. FBI
2024-05 Cryptocurrency investors worldwide A fake blockchain tank game site exploits a Chrome zero-day (CVE-2024-4947) plus a V8 sandbox bypass; Kaspersky ties it to Lazarus and its BlueNoroff subgroup. Kaspersky
2024-06 Aerospace and cryptocurrency engineering staff Zero-day in the Windows AFD.sys driver (CVE-2024-38193), T1068 (Exploitation for Privilege Escalation), used to load a new FudModule rootkit, T1014 (Rootkit). Gen
2024-02 Not disclosed Admin-to-kernel zero-day in the appid.sys AppLocker driver (CVE-2024-21338) gives FudModule kernel read/write without dropping a vulnerable driver. Avast
2023-03 to 2023-12 Manufacturing, agriculture and physical security companies, including a South American agricultural firm Operation Blacksmith: Log4Shell exploited on VMware Horizon servers, then the new Telegram-controlled NineRAT and DLRAT. Talos notes overlap with Andariel, which it treats as a Lazarus sub-group. Cisco Talos
2023-10 to 2023-11 CyberLink users; TeamCity build servers Microsoft sees Diamond Sleet exploiting JetBrains TeamCity (CVE-2023-42793) and distributing a modified, signed CyberLink installer, T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Microsoft, Microsoft
2023-09 Stake.com online casino About $41 million stolen on or around Sept. 4; the FBI attributes it to Lazarus Group (also known as APT38). FBI
2023-08 Internet backbone infrastructure and healthcare entities in Europe and the US ManageEngine ServiceDesk flaw (CVE-2022-47966) exploited five days after public proof-of-concept code, delivering QuiteRAT. Cisco Talos
2022-06 Harmony Horizon bridge About $100 million in virtual currency stolen; the FBI confirmed Lazarus (also known as APT38) in January 2023. FBI
2022-03 Ronin bridge (Axie Infinity) About $620 million in Ethereum stolen; the FBI names Lazarus Group and APT38. CISA’s TraderTraitor advisory the same month describes trojanized crypto apps pushed to blockchain-company staff. FBI, CISA AA22-108A
2022-02 US news media, IT, cryptocurrency and fintech organizations Google TAG sees two North Korean clusters, publicly tracked as Operation Dream Job and Operation AppleJeus, exploiting a Chrome zero-day (CVE-2022-0609); the Dream Job wave targeted more than 250 people with fake job offers. Google TAG
2021 (autumn) Aerospace company in the Netherlands; political journalist in Belgium Amazon-themed job lures; a user-mode tool abuses a vulnerable Dell driver (CVE-2021-21551) to switch off seven Windows monitoring mechanisms, the first recorded in-the-wild abuse of that flaw. ESET
2021-02 Banks, cryptocurrency firms and companies worldwide The US indicts three RGB hackers over attempted thefts of more than $1.3 billion and the AppleJeus fake crypto-trading apps; CISA, the FBI and Treasury publish an AppleJeus advisory the same day. US Justice Department, CISA AA21-048A
2021-01 Security researchers Fake researcher personas on Twitter and LinkedIn, a fake research blog and a backdoored Visual Studio project, T1566.003 (Phishing: Spearphishing via Service). Microsoft attributes the campaign to ZINC. Google TAG, Microsoft
2019-09 Not applicable (sanctions) Treasury designates Lazarus Group, Bluenoroff and Andariel as controlled by the RGB. US Treasury
2017-05 Hundreds of thousands of computers worldwide, including UK hospitals WannaCry ransomware worm; charged in the 2018 criminal complaint against North Korean programmer Park Jin Hyok. US Justice Department
2016-02 Bangladesh Bank $81 million stolen through fraudulent SWIFT transfers; charged in the same 2018 complaint. MITRE tracks the bank-heist operations as APT38. US Justice Department
2014-11 Sony Pictures Entertainment Destructive wiper attack and data leak ahead of the film The Interview, T1485 (Data Destruction). The FBI concluded the North Korean government was responsible. FBI
2009 South Korean and US targets Earliest activity MITRE attributes to the group; its malware links to Operation Troy, DarkSeoul and Ten Days of Rain. MITRE ATT&CK

Target vectors risk profile

Crypto/DeFi Defense Finance Technology/SaaS Software supply chain Payments/SWIFT Media/journalists Education/research Healthcare Manufacturing Telecom Government Ransomware/extortion Disruption/wiper Energy
High High High High High Medium Medium Medium Medium Medium Medium Low Medium Medium Low

Malware and tools

Name What it does Public detection Hunt Leads Reports
TouchShift, ClientHub, LPEClient, Cubridge FlashHole chain: side-loaded loader, HTTP or Dropbox backdoor, a downloader with ML-KEM-1024 key exchange, and a framework that steals Chromium credentials and queries Active Directory Indicators in Kaspersky’s report 9 Hunt Leads Kaspersky
ThreatNeedle, wAgent, SIGNBT, COPPERHEDGE Long-running Lazarus backdoors and loaders, updated for the SyncHole campaign Indicators in Kaspersky’s report Kaspersky
FudModule Data-only kernel rootkit that switches off security monitoring, loaded through Windows zero-days Indicators in the Avast and Gen reports Avast, Gen
ScoringMathTea RAT delivered through trojanized open-source apps in Operation Dream Job Indicators in ESET’s malware-ioc repository ESET
Comebacker, Blindingcan (with Medusa ransomware) Lazarus backdoor/loader and RAT used alongside Medusa ransomware in the extortion attacks Symantec reported in 2026 Indicators in Symantec’s report Symantec
NineRAT, DLRAT D-language RATs, NineRAT controlled through Telegram, dropped after Log4Shell exploitation Indicators in Talos IOC repository Cisco Talos
QuiteRAT, MagicRAT Small Qt-based RATs deployed on exploited ManageEngine servers Indicators in Talos’s report Cisco Talos
AppleJeus Trojanized cryptocurrency trading apps for Windows and macOS Indicators in CISA AA21-048A; community YARA rules in signature-base CISA AA21-048A
WannaCry Self-spreading ransomware worm released in May 2017 Community YARA rules in signature-base MITRE ATT&CK

Reports

Date Source Report
2026-10-23 CYFIRMA Suspected DPRK campaign staging PHP2Shell targeting against global PHP infrastructure
2026-10-21 Kaspersky Operation FlashHole: Lazarus breaks security, defies control
2026-02-24 Symantec North Korean Lazarus Group now working with Medusa ransomware
2025-10-23 ESET Gotta fly: Lazarus targets the UAV sector
2025-04-24 Kaspersky Operation SyncHole: Lazarus APT goes back to the well
2025-02-26 FBI North Korea responsible for $1.5 billion Bybit hack
2024-10-23 Kaspersky The crypto game of Lazarus APT: investors vs. zero-days
2024-09-19 Gen Evolution of Lazarus FudModule: no longer (stand)alone
2024-02-28 Avast Lazarus and the FudModule rootkit: beyond BYOVD with an admin-to-kernel zero-day
2023-12-11 Cisco Talos Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
2023-11-22 Microsoft Diamond Sleet supply chain compromise distributes a modified CyberLink installer
2023-10-18 Microsoft Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability
2023-08-24 Cisco Talos Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT
2022-09-30 ESET Amazon-themed campaigns of Lazarus in the Netherlands and Belgium
2022-04-18 CISA, FBI, Treasury TraderTraitor: North Korean state-sponsored APT targets blockchain companies
2022-03-24 Google TAG Countering threats from North Korea
2021-02-17 CISA, FBI, Treasury AppleJeus: analysis of North Korea’s cryptocurrency malware
2021-02-17 US Justice Department Three North Korean military hackers indicted in wide-ranging scheme
2021-01-25 Google TAG New campaign targeting security researchers
2019-09-13 US Treasury Treasury sanctions North Korean state-sponsored malicious cyber groups
2018-09-06 US Justice Department North Korean regime-backed programmer charged with conspiracy to conduct multiple cyber attacks
2014-12-19 FBI Update on Sony investigation

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2024-38193 7.8 High Microsoft Windows Ancillary Function Driver for WinSock (AFD.sys) Yes
CVE-2024-21338 7.8 High Microsoft Windows kernel (appid.sys AppLocker driver) Yes
CVE-2024-4947 9.6 Critical Google Chrome (V8) Yes
CVE-2023-42793 9.8 Critical JetBrains TeamCity Yes
CVE-2022-47966 9.8 Critical Zoho ManageEngine ServiceDesk Plus and other on-premise products Yes
CVE-2022-0609 8.8 High Google Chrome Yes
CVE-2021-44228 10.0 Critical Apache Log4j (exploited on VMware Horizon) Yes
CVE-2021-21551 7.8 High Dell dbutil_2_3.sys driver Yes

If you’re in their sights

Do this now

  1. Treat unsolicited job offers, coding tests and “please review my résumé or portfolio” links as a delivery method, not a courtesy. Tell engineers, crypto staff and researchers to run anything sent by a recruiter in a throwaway VM, never on a work laptop with wallet or signing access.
  2. Patch internet-facing build and IT tools fast: TeamCity, ManageEngine, Log4j-based products and anything else the group has hit within days of disclosure. Keep browsers and Windows current; this group has burned several Chrome and Windows kernel zero-days.
  3. Turn on Microsoft’s vulnerable driver blocklist and watch for new kernel drivers or services appearing on endpoints. FudModule and the Dell driver abuse were built to blind your security tools first.
  4. If you hold crypto or run a bridge or exchange, put hardware-key signing and multi-party approval on every hot-wallet and contract change, with no single signer or verifier. The biggest Lazarus thefts went through one compromised developer machine or one weak approval path.
  5. In South Korea, inventory and remove banking and file-transfer security plug-ins (CrossWeb EX, Innorix Agent and similar) that no site still needs, and update the rest.

Compiled from US Justice Department, FBI, Treasury and CISA actions, Kaspersky, Microsoft, ESET, Google TAG, Cisco Talos, Avast, Gen, Symantec, CYFIRMA and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 1, 2026.

ATT&CK techniques (93)

Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.

Reconnaissance 2
Resource Development 8
Initial Access 5
Execution 10
Persistence 7
Privilege Escalation 8
Stealth 23
Defense Impairment 3
Credential Access 3
Discovery 11
Lateral Movement 3
Collection 7
Command and Control 11
Exfiltration 2
Impact 6

Software MITRE links to this group (26)

AppleJeus AuditCred BADCALL Bankshot BLINDINGCAN Cryptoistic Dacls Dtrack ECCENTRICBANDWAGON FALLCHILL HARDRAIN HOPLIGHT HotCroissant KEYMARBLE MagicRAT netsh Proxysvc RATANKBA RawDisk Responder route TAINTEDSCRIBE ThreatNeedle TYPEFRAME Volgmer WannaCry

ThreatRoundup coverage

2 of these stories have Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.