Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Lazarus Group · Nation-state · assessed origin North Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

Lazarus Group

  • Operation DarkSeoul
  • Dark Seoul
  • Hidden Cobra
  • Hastati Group
  • Andariel
  • Unit 121
  • Bureau 121
  • NewRomanic Cyber Army Team

state sponsor · Korea (Democratic People's Republic of)MITRE G1036 ↗

Lazarus Group — ATT&CK roseLG

attack rose · 30 techniques across 10 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2018-4878, CVE-2023-42793, CVE-2024-38106, CVE-2024-7971, CVE-2026-68820

Analyst brief

misp-galaxy + mitre-attack

Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

Observed targets (as stated by the sources)

15 countries · 2 sectors
South KoreaBangladeshUnited StatesThailandFranceChinaHong KongUnited KingdomGuatemalaCanadaJapanIndiaGermanyBrazilAustraliaAssessed origin: North Korea

assessed origin · North Koreaobserved targets · 15

countries · 15

  • South Korea
  • Bangladesh
  • United States
  • Thailand
  • France
  • China
  • Hong Kong
  • United Kingdom
  • Guatemala
  • Canada
  • Japan
  • India
  • Germany
  • Brazil
  • Australia

sectors · 2

  • Government
  • Private sector

also stated: Sony Pictures Entertainment, Cryptocurrency exchanges in South Korea

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

30 techniques · 10 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    7 techniques

  3. Initial access

    3 techniques

  4. Execution

    3 techniques

  5. Persistence

    1 technique

  6. Stealth

    4 techniques

  7. Credential access

    1 technique

  8. Discovery

    4 techniques

  9. Command and control

    2 techniques

  10. Impact

    1 technique

select a technique

Arsenal

1 malware · 4 tools
Malware
Malware · 1ATT&CK
QilinS1242 ↗
Tools
Tools · 4ATT&CK
RawDiskS0364 ↗
netshS0108 ↗
routeS0103 ↗
ResponderS0174 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to Lazarus Group

1 on CISA KEV
  1. CVE-2026-68820KEV2026-08-21
    1. “Earlier this month, Redmond also patched a high-severity security privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock (CVE-2026-68820, CVSS score: 7.0) that was exploited as a zero-day by the North Korea-linked Lazarus Group as part of a long-running campaign dubbed Operation Dream Job.”

      cited as exploiting · source: thehackernews.com ↗ · 2026-10-17

  2. CVE-2023-427932026-10-17
    1. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

    2. “Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

  3. CVE-2018-48782026-10-17
    1. “Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2024-381062026-10-17
    1. “Microsoft released a security update on August 13, 2024, for the CVE-2024-38106 vulnerability exploited by Diamond Sleet”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “our investigations so far have not suggested any link between the reported CVE-2024-38106 exploit activity and this Citrine Sleet exploit activity, beyond exploiting the same vulnerability.”

      attributed by a report · named nearby · source: microsoft.com ↗

  5. CVE-2024-79712026-10-17
    1. “The updated variant of FudModule exhibited an attack chain similar to that seen in Citrine Sleet’s zero-day exploit of CVE-2024-7971.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Lazarus group using public certificate vulnerabilityAhnlab ↗
  2. 2018Hidden Cobra Targets Turkish Financial Sector With New Bankshot ImplantMcAfee ↗
  3. 2018Lazarus Group Targets More Cryptocurrency Exchanges and FinTech CompaniesIntezer ↗
  4. 2013Dissecting Operation Troy: Cyberespionage In South KoreaMcAfee ↗
  5. 2013Dark Seoul Cyber Attack: Could It Be Worse? Dongseo University ↗

Take it with you

keyless · no signup

References

86 sources
  1. 1.threatpost.com/operation-blockbuster-coalition-ties-destructive-attac…
  2. 2.us-cert.gov/ncas/alerts/TA17-164A
  3. 3.us-cert.gov/ncas/alerts/TA17-318A
  4. 4.us-cert.gov/ncas/alerts/TA17-318B
  5. 5.securelist.com/operation-applejeus/87553
  6. 6.securelist.com/lazarus-under-the-hood/77908
  7. 7.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
  8. 8.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-ope…
  9. 9.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-a…
  10. 10.cfr.org/interactive/cyber-operations/lazarus-group
  11. +76 more in the JSON record

Track Lazarus Group on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.