Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
Threat Actor Profile
Lazarus Group
The Lazarus Group, also tracked as HIDDEN COBRA, ZINC, Labyrinth Chollima, and Guardians of Peace, is a North Korean state-sponsored cybercriminal organization. Operating since at least 2009, Lazarus encompasses a cluster of North Korean cyber operations specialising in financial theft, cyber espionage, and destructive cyberattacks. They have targeted industries such as finance, government, and critical infrastructure, utilizing sophisticated tactics and custom malware.
Threat Actor Profile
Lazarus Group
Fancy Bear TTPs
Aenean interdum tempor lectus, nec rutrum nisl interdum ut. Aliquam mattis felis vulputate dui ultrices, ac finibus ligula interdum. Proin metus enim, sagittis fringilla viverra quis, pulvinar sit amet quam. Donec eget ullamcorper nibh. Praesent a nisl eu nunc interdum efficitur.
Country of Origin
Lazarus Group is linked to North Korea and is believed to operate under the Reconnaissance General Bureau, the primary intelligence agency of the Democratic People’s Republic of Korea (DPRK). The group’s activities align with state objectives, including financial gain for an economy burdened by international sanctions and furthering the regime’s political goals.
Members
The Lazarus Group is structured into specialized subgroups with distinct operational mandates. Bluenoroff (also tracked as APT38, Stardust Chollima, Sapphire Sleet) targets large-scale financial heists, cryptocurrency exchanges, and SWIFT banking systems — responsible for the Bangladesh Bank heist and billions in subsequent crypto theft. Andariel focuses on espionage operations primarily targeting South Korean defense, government, and critical infrastructure entities, and has increasingly conducted ransomware operations against healthcare organizations globally.
Leadership
The leadership of the Lazarus Group remains largely unidentified. However, it is reportedly governed by North Korea’s Reconnaissance General Bureau. Notably, Park Jin Hyok, a member of the Chosun Expo Joint Venture, was charged in 2018 by the U.S. Department of Justice for his involvement in Lazarus-associated operations.
Tactics
Financial theft and fund transfer manipulation, such as SWIFT attacks.
Espionage campaigns for collecting confidential data.
Disruption through ransomware and wiper malware.
Techniques
Initial Access: Spear-phishing emails and watering hole attacks.
Execution: Use of PowerShell scripts and malicious macros in documents.
Persistence: Scheduled tasks, registry run keys, or custom malware implants.
Privilege Escalation: Exploitation of software vulnerabilities.
Defense Evasion: Fileless malware and disguise as legitimate software.
Credential Access: Keylogging and credential dumping via Mimikatz.
Discovery: Network and system enumeration using tools like Nmap.
Lateral Movement: Pass-the-hash and PsExec for network traversal.
Collection: Data staging and exfiltration tools like RAR archives.
C2 (Command & Control): Use of compromised servers and encrypted channels.
Exfiltration: HTTP/HTTPS protocols for data theft.
Procedures
Lazarus continuously develops custom tools and evolves methods. Key malware includes:
WannaCry ransomware.
AppleJeus cryptocurrency malware.
RATANKBA (remote access tools)
Want to shut down threats before they start?
Indicators of Compromise (IOCs)
Organizations should monitor for:
- Known Fancy Bear malware signatures (e.g., XAgent, ADVSTORESHELL).
- Suspicious domains mimicking government or defense entities.
- Zero-day exploits in applications like Microsoft Windows and Adobe Flash.
- Abnormal network traffic patterns indicating command-and-control communications.
Key Victims
Fancy Bear targets include:
- Governments (United States, Germany, France, Ukraine, and others).
- Military Organizations (focus on NATO-aligned entities).
- Media Outlets and Journalists (especially those covering Kremlin-related topics).
- Critical Infrastructure (energy, aerospace, and defense).
- International Sporting Organizations (e.g., WADA).
- Political Groups (e.g., the Democratic National Committee).
Notable Cyber Attacks
Aenean interdum tempor lectus, nec rutrum nisl interdum ut. Aliquam mattis felis vulputate dui ultrices, ac finibus ligula interdum. Proin metus enim, sagittis fringilla viverra quis, pulvinar sit amet quam. Donec eget ullamcorper nibh. Praesent a nisl eu nunc interdum efficitur.
Notable Cyberattacks
How to Defend Against Lazarus Group
1
Endpoint Detection and Response (EDR): Solutions like Huntress can detect threats at multiple stages of an attack, preventing compromise from escalating.
2
Network Segmentation: Restrict lateral movement by isolating sensitive systems.
3
Threat Intelligence Monitoring: Track Lazarus-specific IOCs to block malicious infrastructure.
4
User Awareness Training: Reduce phishing susceptibility through training initiatives.
5
Secure Configurations: Harden systems by patching known vulnerabilities and disabling unnecessary services.
Huntress solutions help protect organizations by monitoring endpoints, detecting intrusions, and mitigating threats like Lazarus Group with enterprise-grade technology.
Law Enforcement & Arrests
The U.S. Department of Justice indicted Park Jin Hyok in 2018 for his alleged role in Lazarus operations. Sanctions have been imposed on North Korean entities accused of supporting cyber campaigns, which include Lazarus (source).
References
Related Threat Actor Profiles
Notable developments include the U.S. indictment of GRU-affiliated officers in 2018. Despite these measures, Fancy Bear remains operational, emphasizing the challenges of deterring state-sponsored cyber actors.
