lazarus-group

name	lazarus-group
description	Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"lazarus, lazarus group, hidden cobra, diamond sleet, labyrinth chollima, zinc, guardians of peace, nickel academy, north korea, dprk, rgb, applejeus, tradertraitor, operation dream job, 3cx, fastcash, wannacry, bangladesh bank swift, cryptocurrency theft, fake job offer, supply chain, G0032, emulate north korean apt","tags":"adversary-emulation, threat-intel, lazarus, north-korea, dprk, hidden-cobra, diamond-sleet, financial-crime, cryptocurrency, supply-chain, wiper, espionage, mitre-attack, G0032","mitre_attack":"T1087.002, T1010, T1083, T1589.002, T1591.004, T1046, T1057, T1012, T1018, T1082, T1614.001, T1016, T1049, T1033, T1124, T1593.001, T1189, T1566.001, T1566.002, T1566.003, T1204.001, T1204.002, T1059.001, T1059.003, T1059.005, T1106, T1053.005, T1218.005, T1218.010, T1218.011, T1047, T1220, T1203, T1221, T1547.001, T1547.009, T1543.003, T1542.003, T1505.004, T1134.002, T1548.002, T1197, T1140, T1622, T1070.003, T1070.004, T1070.006, T1564.001, T1574.001, T1036.004, T1036.005, T1027.002, T1027.007, T1027.009, T1553.002, T1497.001, T1497.003, T1620, T1098, T1110.003, T1557.001, T1056.001, T1021.001, T1021.002, T1021.004, T1078, T1119, T1560.001, T1560.003, T1005, T1074.001, T1041, T1567.002, T1048.003, T1071.001, T1573.001, T1008, T1571, T1090.001, T1090.002, T1102.002, T1105, T1104, T1485, T1561.001, T1561.002, T1489, T1529, T1491.001, T1587.001, T1588.003"}

Lazarus Group (Hidden Cobra, Diamond Sleet, Labyrinth Chollima) — Adversary Emulation Profile

Lazarus Group (MITRE ATT&CK G0032) is a North Korean state-sponsored threat actor active since at least 2009 and attributed by the U.S. Government and the security industry to the DPRK's Reconnaissance General Bureau (RGB). It is one of the most versatile and prolific nation-state actors observed, running three overlapping mission types in parallel: strategic espionage, destructive/disruptive attacks (e.g., the 2014 Sony Pictures wiper and the 2017 WannaCry outbreak), and large-scale financially motivated theft to fund the sanctioned regime (SWIFT bank fraud, ATM "FASTCash" cash-outs, and cryptocurrency heists). MITRE and vendors track several clusters/aliases under or alongside the Lazarus umbrella — HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet (Microsoft), and Labyrinth Chollima (CrowdStrike) — with financial sub-clusters often labeled APT38 / BlueNoroff / Stardust Chollima. The group blends bespoke malware, trojanized legitimate software, supply-chain compromise, and elaborate social engineering (fake recruiter "job offers") to reach hardened targets.

Attribution & motivation

• Suspected sponsor / nation: North Korea (DPRK), tied to the Reconnaissance General Bureau (RGB). The U.S. Government uses the umbrella name HIDDEN COBRA for DPRK malicious cyber activity.
• Motivation (mixed):
  • Financial — sanctions-driven revenue generation: SWIFT interbank fraud, FASTCash ATM cash-outs, and cryptocurrency theft from exchanges, DeFi, and blockchain firms.
  • Espionage — collection against defense, aerospace, government, and crypto/fintech targets, frequently via fake-job-offer lures (Operation Dream Job).
  • Destructive / disruptive — wiper and ransomware operations (Sony Pictures 2014; WannaCry 2017).
• Confidence of attribution: High. Backed by a 2018 U.S. DOJ criminal complaint naming DPRK programmer Park Jin Hyok, multiple joint FBI/CISA/Treasury/USCYBERCOM advisories, and corroborating Mandiant/ESET/Kaspersky/Microsoft reporting. Individual sub-cluster boundaries (Lazarus vs. APT38/BlueNoroff) carry moderate analyst-to-analyst variance.

Targeting

• Sectors: financial services and banks (SWIFT endpoints, ATM switch infrastructure), cryptocurrency exchanges / blockchain / DeFi / Web3 and crypto-related software, defense and aerospace, government, media/entertainment, energy, gaming, and IT/DevOps personnel at high-value firms.
• Regions: global. Heavy activity against the United States, South Korea, Japan, and Europe, with bank-fraud operations reaching South/Southeast Asia, Africa, and Latin America.