Nation-stateFinancial gainEspionageDisruptionATT&CK G0032

Lazarus Group

Also known as: HIDDEN COBRA, Labyrinth Chollima, ZINC, Diamond Sleet, Guardians of Peace

Lazarus is linked to some of the largest thefts and most disruptive attacks on record, from the Sony Pictures wiper attack to the Bangladesh Bank heist, WannaCry and the theft of about $1.5 billion from the Bybit exchange. Recent operations lean on social engineering: fake job offers and trojanised cryptocurrency apps aimed at developers.

Public attribution: Publicly attributed by the US government to North Korea's Reconnaissance General Bureau (RGB). MITRE notes the name is often used as an umbrella for several North Korean units.
Active since: Around 2009
Targets: Banks, cryptocurrency exchanges and blockchain companies
Defence and aerospace
Media and entertainment
Organisations worldwide

Notable campaigns

2014Sony Pictures Entertainment
A destructive wiper attack that MITRE ATT&CK reports the group is responsible for.
2016-2017Bangladesh Bank theft and WannaCry
A 2018 US criminal complaint against a North Korean programmer covered the $81 million Bangladesh Bank theft, WannaCry and the Sony attack.
2022TraderTraitor
US agencies warned of recruitment-themed lures that persuaded staff at blockchain companies to run trojanised cryptocurrency applications.
2025Bybit theft
The FBI attributed the theft of about $1.5 billion in virtual assets from Bybit to North Korea (TraderTraitor).

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Warn developers and finance staff about job-offer lures and test tasks delivered over social media or messaging apps.
Isolate cryptocurrency signing infrastructure and require multi-party approval for large transfers.
Restrict execution of unsigned or newly seen binaries on high-value workstations.
Keep offline backups to survive wiper attacks.

Learn and practise on CyberCertPrep

Haxplain: phishing Glossary: ransomware Malware triage lab

Sources

Notable campaigns

2014Sony Pictures Entertainment

A destructive wiper attack that MITRE ATT&CK reports the group is responsible for.

2016-2017Bangladesh Bank theft and WannaCry

A 2018 US criminal complaint against a North Korean programmer covered the $81 million Bangladesh Bank theft, WannaCry and the Sony attack.

2022TraderTraitor

US agencies warned of recruitment-themed lures that persuaded staff at blockchain companies to run trojanised cryptocurrency applications.

2025Bybit theft

The FBI attributed the theft of about $1.5 billion in virtual assets from Bybit to North Korea (TraderTraitor).

Defences that work against this actor

Warn developers and finance staff about job-offer lures and test tasks delivered over social media or messaging apps.

Isolate cryptocurrency signing infrastructure and require multi-party approval for large transfers.

Restrict execution of unsigned or newly seen binaries on high-value workstations.

Keep offline backups to survive wiper attacks.