Lazarus Group

Overview

Lazarus Group is not a single threat actor but an umbrella term for multiple operational clusters operating under North Korea's Reconnaissance General Bureau. Mandiant's 2024 assessment identified at least six distinct sub-groups under the RGB, each with its own specialization: Alluring Pisces (APT38/Bluenoroff) targets financial institutions; Gleaming Pisces (Citrine Sleet) focuses on cryptocurrency platforms; and other clusters conduct espionage, destructive operations, and the increasingly significant IT worker infiltration scheme. These groups share infrastructure, tools, and intelligence, but operate with distinct tradecraft and targeting profiles.

What makes Lazarus fundamentally different from other state-sponsored threat actors is its financial mission. While Russian, Chinese, and Iranian APTs primarily conduct espionage, Lazarus Group's core function is generating revenue for the North Korean regime. A 2024 United Nations report documented 58 suspected cyberattacks on cryptocurrency-related companies between 2017 and 2023 valued at approximately $3 billion. The regime has effectively industrialized cryptocurrency theft as a primary revenue stream, circumventing international sanctions that have crippled its traditional economy. As TRM Labs has stated: "Lazarus Group is not state-sponsored in the traditional way. Lazarus Group is North Korea and North Korea is Lazarus Group."

The February 2025 Bybit heist demonstrated the current peak of this capability. In approximately 30 minutes, the group drained $1.5 billion in Ethereum from Bybit's cold storage through a supply chain attack on Safe{Wallet}'s development environment. Within 48 hours, over $160 million had been laundered through thousands of blockchain addresses. By March 2025, 86% of the stolen ETH had been converted to Bitcoin and dispersed. The FBI confirmed attribution and released 51 Ethereum addresses used in laundering, but recovery of the funds remains unlikely. The Bybit heist alone represented roughly one-third of all cryptocurrency stolen globally in 2025.

Beyond financial crime, Lazarus maintains capabilities for espionage, sabotage, and destructive attacks. The group was responsible for the 2014 Sony Pictures breach (destruction of 70% of corporate laptops), the 2016 Bangladesh Bank SWIFT heist ($81 million stolen), and the 2017 WannaCry ransomware outbreak that infected over 200,000 systems across 150 countries. In 2025, researchers discovered evidence suggesting possible infrastructure sharing between Lazarus and Russia's Gamaredon group — the first known case of Russian-North Korean operational cyber collaboration, reflecting the deepening geopolitical alliance between Moscow and Pyongyang.

Target Profile

Lazarus Group's targeting reflects its dual mission: revenue generation and strategic intelligence collection for the North Korean regime.

• Cryptocurrency exchanges and DeFi platforms: The primary revenue-generating target. Confirmed thefts include Bybit ($1.5B, 2025), Ronin/Axie Infinity ($625M, 2022), WazirX ($235M, 2024), Atomic Wallet ($100M, 2023), Stake.com ($41M, 2023), and dozens of other platforms. The group targets both centralized exchanges and decentralized finance protocols, adapting its techniques to each architecture.
• Financial institutions and SWIFT networks: The Bangladesh Bank heist ($81M, 2016) exploited the SWIFT interbank messaging system. The group has targeted banks across Southeast Asia, Africa, and Latin America.
• Defense contractors and government agencies: Operation Dream Job and Operation North Star targeted defense and aerospace companies through fake job recruitment campaigns. South Korean government agencies and military organizations are persistent targets.
• Technology and software supply chains: The 3CX supply chain compromise (2023) and the Bybit heist (via Safe{Wallet} developer compromise) demonstrate the group's capability to infiltrate software vendors and poison trusted update mechanisms.
• Healthcare: HHS warned in 2023 that Lazarus was actively targeting the U.S. healthcare sector. Healthcare data and ransomware payments provide additional revenue streams.
• IT worker infiltration: North Korean operatives use stolen identities to secure remote IT positions at Western companies, gaining both income and insider access. This has expanded from a handful of cases to a systematic program affecting companies across technology, finance, and other sectors.

Tactics, Techniques & Procedures

mitre id	technique	description
T1195.002	Supply Chain Compromise	Core capability. Compromised 3CX software supply chain (2023) and Safe{Wallet} development environment (2025 Bybit heist). Injects malicious code into trusted software updates and development pipelines.
T1566.003	Spearphishing via Service	Operation Dream Job and DEV#POPPER campaigns use fake job offers on LinkedIn and professional networks, luring targets into downloading malicious attachments disguised as job descriptions, coding tests, or interview materials.
T1059	Command and Scripting Interpreter	Extensive use of custom malware across Windows, macOS, and Linux: MagicRAT, QuiteRAT, LPEclient, InvisibleFerret, OdicLoader, Comebacker, and dozens of others. Modular architecture allows rapid capability scaling.
T1071	Application Layer Protocol	Uses legitimate services for C2 including social media platforms, cloud storage, and messaging apps. The Telegram channels and Telegraph publishing platform are used for coordination and misdirection.
T1657	Financial Theft	Primary operational objective. Cryptocurrency theft via smart contract manipulation, SWIFT system exploitation, and exchange compromise. Stolen funds laundered through mixers, DEXs, cross-chain bridges, and thousands of intermediary wallets.
T1561	Disk Wipe	Maintains destructive capability. Malware families KILLMBR, QDDOS, and DESTOVER designed to render systems inoperable after data theft. Used in the Sony Pictures attack (2014) and South Korean campaigns.
T1189	Drive-by Compromise	SyncHole campaign (2024-2025) against South Korea combined watering hole attacks with zero-day exploitation of mandatory financial software. Targets specific to the South Korean technology ecosystem.
T1078	Valid Accounts	IT worker infiltration scheme uses stolen identities to obtain legitimate employment credentials at Western companies, providing authorized access to internal networks and systems without any exploitation required.

Known Campaigns

Tools & Malware

Lazarus Group maintains one of the largest custom malware arsenals of any threat actor, spanning Windows, macOS, and Linux.

• MagicRAT / QuiteRAT: Remote access trojans providing persistent backdoor access. QuiteRAT is a newer, lighter variant designed to evade detection that emerged in 2023 campaigns.
• InvisibleFerret: Multi-platform malware used in the ContagiousInterview campaign targeting job seekers. Distributed through fake recruitment processes. Linked to the possible Gamaredon-Lazarus infrastructure overlap discovered in July 2025.
• OdicLoader: Linux downloader that masquerades as a PDF file using Unicode character substitution, causing graphical file managers to execute the ELF binary when double-clicked instead of opening a PDF viewer.
• AppleJeus: macOS and Windows malware distributed through fake cryptocurrency trading applications. Multiple variants targeting the cryptocurrency industry since 2018.
• DESTOVER / KILLMBR / QDDOS: Destructive malware designed to wipe disk data and render systems inoperable. Used in the Sony Pictures attack and South Korean infrastructure campaigns.
• LPEclient: Privilege escalation tool used across multiple campaigns to gain elevated access on compromised systems.
• Comebacker: Malware originally used to target security researchers in 2020, later distributed as malicious packages on PyPI, demonstrating the group's willingness to target the security research community itself.
• Custom SWIFT manipulation tools: Specialized tools for interacting with the SWIFT interbank messaging system, used in the Bangladesh Bank heist and related financial institution targeting.

Mitigation & Defense

Defending against Lazarus Group requires a layered approach addressing social engineering, supply chain integrity, and cryptocurrency-specific controls.

• Verify remote employee identities: The IT worker infiltration scheme means traditional perimeter defenses are insufficient. Implement rigorous identity verification for remote hires including video-verified interviews, background checks that go beyond document verification, and ongoing access monitoring for remote workers.
• Software supply chain integrity: Verify code signing certificates and validate software updates through independent hash verification. The 3CX and Bybit attacks demonstrate that Lazarus targets trusted software pipelines. Isolate build environments and implement reproducible builds where possible.
• Cryptocurrency security: For organizations handling digital assets: use hardware security modules for key management, implement time-delayed withdrawals for large transfers, verify transaction details independently of the signing interface (the Bybit attack worked because signers couldn't see the real transaction), and maintain cold storage that is genuinely air-gapped.
• Social engineering resilience: Train staff to recognize fake job offers, particularly on LinkedIn and professional networks. Lazarus invests significant effort in making recruitment lures appear legitimate. Verify recruiter identities through company directories before downloading any materials.
• SWIFT and financial messaging security: Financial institutions should implement the SWIFT Customer Security Programme controls, restrict SWIFT operator access, and monitor for anomalous transaction patterns outside business hours.
• Cross-platform endpoint protection: Lazarus targets Windows, macOS, and Linux. Ensure security monitoring and EDR coverage spans all three operating systems, including development workstations that may be running macOS or Linux.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — Lazarus Group (G0032)
• Palo Alto Unit 42 — Threat Assessment: North Korean Threat Groups (2024)
• TRM Labs — The Bybit Hack: Following North Korea's Largest Exploit (2025)
• Barracuda Networks — Lazarus Group: A Criminal Syndicate with a Flag (2025)
• Gen Digital — Alliances of Convenience: How APTs Are Beginning to Work Together (2025)
• CSIS — The ByBit Heist and the Future of U.S. Crypto Regulation (2025)