Lazarus Group
Attribution profile
- Type
- Nation State
- Location
- North Korea
- Known incidents
- 91 incidents
- Sources
- 65 sources
- First seen
- 2014-11-24
- Last seen
- 2025-07-19
- Updated
- 2026-10-14 16:04
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
BlueNoroff, also known as Lazarus Group, Hidden Cobra and APT38, is a North Korea‑linked threat actor. It targets cryptocurrency exchanges, financial institutions, healthcare providers and defense organizations, seeking financial gain to support the regime’s weapons program, conducting espionage to steal sensitive data, and causing disruption through ransomware. Observed tactics include phishing emails with malicious Word documents, ZIP files or ISO/VHD attachments, supply‑chain compromises of third‑party developers, and the use of malware families such as Dtrack, WannaCry, PowerRatankba and INLETDRIFT, often combined with living‑off‑the‑land binaries, fake domains mimicking banks and venture‑capital firms, and social‑engineering via LinkedIn job ads or fake tech‑worker personas. For financial thefts the actor employs complex native swaps, cross‑chain transactions and mixers like Sinbad and Tornado Cash to obscure fund flows, while disabling antivirus and establishing persistence through startup‑folder scripts. Public attribution ties the group to North Korea’s Reconnaissance General Bureau and its Bureau 121, with sub‑groups such as Kimsuky and Andariel also linked. Notable operations include the $1.5 billion Ethereum theft from Bybit (2025), the WannaCry ransomware campaign (2017), the $81 million Bangladesh Bank heist (2016), the intrusion of a Seoul hospital network (2021) and the Redbanc inter‑bank breach (2018).
Incidents
Attributed incidents are available to members.
91 incidentsSources
Sources available to members: 65 sources.