Threat Actor: Lazarus Group
Lazarus Group is classified as an advanced Nation-State APT originating primarily from North Korea (Reconnaissance General Bureau / DPRK). Driven by operational objectives spanning state-sponsored cyber espionage, sanctions evasion & cryptocurrency theft, this threat entity has maintained an active footprint from 2009 - Present. In enterprise telemetry and malware repository classification, Lazarus Group has been corroborated across 3 distinct malware families with over 4,885 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | HIDDEN COBRA, APT38, Zinc, Labyrinth Chollima, Stardust Chollima, Guardians of Peace |
|---|---|
| Targeted Sectors | Cryptocurrency Exchanges, Global Banking (SWIFT), Defense Aerospace, Critical Infrastructure, Media Organizations |
| Primary Motivations | State-Sponsored Cyber Espionage, Sanctions Evasion & Cryptocurrency Theft |
| Dominant Payload Categories | Worm · Ransomware · Ransomware Worm |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0032/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Lazarus Group:
T1547.001— weaponized across 2 catalog payload(s)T1486— weaponized across 2 catalog payload(s)T1110.001— weaponized across 1 catalog payload(s)T1570— weaponized across 1 catalog payload(s)T1046— weaponized across 1 catalog payload(s)T1071.003— weaponized across 1 catalog payload(s)T1082— weaponized across 1 catalog payload(s)T1070.001— weaponized across 1 catalog payload(s)T1490— weaponized across 1 catalog payload(s)T1059.003— weaponized across 1 catalog payload(s)T1566.001— weaponized across 1 catalog payload(s)T1027— weaponized across 1 catalog payload(s)T1210— weaponized across 1 catalog payload(s)T1083— weaponized across 1 catalog payload(s)T1071.001— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Lazarus Group has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2008-4250 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0144 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0145 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0199 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-11882 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (3 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Lazarus Group:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| brambul | Worm | 2 | Worm:Win32/Brambul is an aggressive network-spreading worm developed by North Korean state-sponsored threat group HIDDEN COBRA (Lazarus Group / APT38). Discover... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Lazarus Group operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Lazarus Group requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).