lazarus-group

name	lazarus-group
description	Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"lazarus, lazarus group, hidden cobra, diamond sleet, labyrinth chollima, zinc, guardians of peace, nickel academy, north korea, dprk, rgb, applejeus, tradertraitor, operation dream job, 3cx, fastcash, wannacry, bangladesh bank swift, cryptocurrency theft, fake job offer, supply chain, G0032, emulate north korean apt","tags":"adversary-emulation, threat-intel, lazarus, north-korea, dprk, hidden-cobra, diamond-sleet, financial-crime, cryptocurrency, supply-chain, wiper, espionage, mitre-attack, G0032","mitre_attack":"T1087.002, T1010, T1083, T1589.002, T1591.004, T1046, T1057, T1012, T1018, T1082, T1614.001, T1016, T1049, T1033, T1124, T1593.001, T1189, T1566.001, T1566.002, T1566.003, T1204.001, T1204.002, T1059.001, T1059.003, T1059.005, T1106, T1053.005, T1218.005, T1218.010, T1218.011, T1047, T1220, T1203, T1221, T1547.001, T1547.009, T1543.003, T1542.003, T1505.004, T1134.002, T1548.002, T1197, T1140, T1622, T1070.003, T1070.004, T1070.006, T1564.001, T1574.001, T1036.004, T1036.005, T1027.002, T1027.007, T1027.009, T1553.002, T1497.001, T1497.003, T1620, T1098, T1110.003, T1557.001, T1056.001, T1021.001, T1021.002, T1021.004, T1078, T1119, T1560.001, T1560.003, T1005, T1074.001, T1041, T1567.002, T1048.003, T1071.001, T1573.001, T1008, T1571, T1090.001, T1090.002, T1102.002, T1105, T1104, T1485, T1561.001, T1561.002, T1489, T1529, T1491.001, T1587.001, T1588.003"}