Lazarus Group (187)
Events whose actors field, as written by the source, names this.
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| Jun 2005 | Targeting of American defense industry | American defense industry | Lazarus Group |
| 2007 | Operation “Flame” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2007 | Possible 2007 attack targeting South Korea | Lazarus Group | |
| 2009 to 2012 | Operation Troy | Lazarus Group | |
| 2013-05 | South Korean Financial Companies Targeted by Castov | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2014; 2016; last year (2017) | Sony Pictures destructive attack; Bangladesh Bank theft; WannaCry 2.0 | North Korea; Lazarus Group | |
| 01.10.2015 | North Korean Lazarus group conducts operations against banks in Vietnam and the Philippines starting in October 2015 | Philippines | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| May 2016 | SWIFT-related bank heists | Bangladesh Central Bank, Tien Phong Bank, Banco Del Austro, Poland | Lazarus Group; In September 2018, the U.S. Department of Justice; announced; criminal charges alleging that North Korean entities were responsible for this incident. |
| 2016 and 2017 | Spear-phishing of U.S. defense contractors including Lockheed Martin | Park Jin Hyok; "Lazarus Group"; Chosun Expo Joint Venture | |
| approximately October 26, 2016 | Watering hole on website of a "South American Bank" | South America | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| 2016-2017 (LinkedIn invitations from March 12, 2016; spear-phishing February 6 and 23, 2017) | Targeting of defense contractors including Lockheed Martin (THAAD prime contractor) and aerospace companies in the U.S. and Israel | U.S.; Israel | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| 2017-08 | The Blockbuster Saga Continues | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.09.2017 | North Korean Lazarus group conducts Operation Sharpshooter against organziations in global defense and critical infrastructure since September 2017 | United States;United States;United States;United States | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.04.2017 | Lazarus (NorthKorea) attacks endusers because of financial interests | Unknown;Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2017 | Lazarus Bitcoin Hijack | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| 2017 Late | Several financial sector and a casino breaches using KillDisk wiping malware in Latin America and USA. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 4/1/2017 | Fake Fundraiser | US / N Korea | |
| 12/1/2017 | DPRK Crypto-laundering | US / N Korea | |
| 2017-01-01 | Bithumb | ||
| September 2018 | CSIS entry 814 | ||
| 2018-04 | Operation “GhostSecret” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.06.2018 | Andariel Group attacks website of South Korean non-profit organisation | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2018-04 | The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-01 | F-Secure’s investigation revealed that a system administrator from the target organization received a phishing document via their personal LinkedIn account. The document masqueraded as a legitimate job advert for a role in a blockchain technology company that matched the employee’s skills. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-08 | Operation “AppleJeus” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-07 | Operation “CryptoCore” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-11 | More Attacks on Cryptocurrency Businesses | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| Feb 2018 | Targeting of global financial organizations and bitcoin users | Lazarus Group; Suspected state sponsor; Korea (Democratic People's Republic of); Type of incident; Espionage; Target category; Private sector; Read more; Lazarus Resurfaces, Targets Global Banks and Bitcoin Users; Footer; Logo; About; Member Programs; Contact; Support; For Media; Newsletters; Membership; Careers; Facebook; YouTube; Instagram; LinkedIn; ©2026 Council on Foreign Relations.; All rights reserved.; Privacy Policy; and; Terms of Use; . | |
| May 2018 | Targeting of North Korean defectors and journalists | South Korea | Lazarus Group |
| Sep 2018 | Targeting of U.S. defense contractors | United States | Lazarus Group |
| 20/11/2018 | Latin American financial institutions | >1 | Lazarus Group |
| 2019-03-27 | 라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습 | Lazarus; 라자루스 | |
| 01.01.2019 | Lazarus turns against Russia | Russia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.09.2019 | Operation In(ter)ception | Europe (region);Middle East (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2019-05 | Hackers associated with the APT Lazarus/HIDDEN COBRA group were found to be breaking into online stores of large US retailers and planting payment skimmers as early as May 2019. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2019-09 | Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 11/28/2019 | South Korean Supply Chains | N Korea / S Korea | |
| Nov 2019 | Targeting of South Korean macOS users | South Korean macOS users | Lazarus Group; The North Korean threat actor; Lazarus Group |
| 10/04/2019 | Multiple Targets | >1 | Lazarus Group (AKA Hidden Cobra) |
| 03/12/2019 | macOS users | >1 | Lazarus Group |
| October 2019 - March 2022 | ‘DeathNote’ campaign (also referred to as ‘Operation Dream Job’) | Lazarus Group | |
| 2020-07 | KAMS | Korea, Republic of | |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | government-backed entity based in North Korea | |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| June 2020 | CSIS entry 612 | ||
| February 2020 | CSIS entry 646 | ||
| 5/1/2020 | COVID disruption_DPRK | US / N Korea | |
| published 2020-08-28 | DOJ forfeiture complaint for 280 addresses tied to two exchange hacks | Lazarus Group | |
| Since January 2020 | AppleJeus campaign against energy, finance, government, industry, technology and telecom sectors in 30+ countries | Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Estonia, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malta, the Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, Slovenia, South Korea, Spain, Sweden, Turkey, the United Kingdom, Ukraine, and the United States | HIDDEN COBRA; Lazarus Group |
| 30.7.2020 (date of listing) | “WannaCry” | APT38 / Lazarus Group (Chosun Expo) | |
| (listing 30.7.2020) | Cyber-attacks against the Polish Financial Supervision Authority | Poland | Chosun Expo; APT38 / Lazarus Group |
| 30.7.2020 (date of listing) | cyber-attacks against … Sony Pictures Entertainment | APT38 / Lazarus Group (Chosun Expo) | |
| 30.7.2020 (date of listing) | cyber-theft from the Bangladesh Bank | APT38 / Lazarus Group (Chosun Expo) | |
| (listing 30.7.2020) | Attempted cyber-theft from the Vietnam Tien Phong Bank | Vietnam | Chosun Expo; APT38 / Lazarus Group |
| published 2020-01-21 (March 2019) | DragonEx exchange breach via fake trading-bot malware | Singapore | Lazarus Group |
| since at least 2020; As of April 2022 | TraderTraitor campaign against blockchain and cryptocurrency firms | Lazarus Group; TraderTraitor; APT38 | |
| Reporting Date: 18 June 2020 | Global COVID 19-related phishing campaign by North Korean operatives Lazarus Group | Singapore; Japan; South Korea (and three other nations) | Lazarus Group |
| 2020-05-15T00:00:43+00:00 | State-sponsored hacker groups join forces to capitalize on COVID-19 pandemic | Lazarus Group (APT38, Hidden Cobra); APT37 (Reaper) | |
| 01.01.2021 | State-sponsored North Korean hacking group Lazarus deployed newly discovered backdoor WinorDLL64 against unspecified South Korean targets since 2021 | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.10.2021 | North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 | Netherlands | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-03 | Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2021-06 | APT actor Lazarus attacks defense industry, develops supply chain attack capabilities | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2021-08-01 | Aug Sept Oct 2021 Hacks | ||
| Nov 2021 | Targeting of Chinese cybersecurity researchers. | Chinese hacking groups | Lazarus Group |
| Apr 2021 | Targeting of South African freight companies | South African shipping companies | Lazarus Group |
| In 2021 | OTC conversion of stolen virtual currency for Lazarus Group (Wu Huihui, Cheng Hung Man) | Lazarus Group | |
| 2022-06 | Harmony Bridge | United States | |
| April 2022 | CSIS entry 353 | ||
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.07.2022 | North Korean State-Sponsored Hacking Group Lazarus Compromised Unnamed Software Vendor Starting In Mid-2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2022 | North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022 | Spain | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2022 | The North Korean state-sponsored hacking group Lazarus gained access into the networks of a defence contractor in Africa and stole data using the DeathNote malware beginning in July 2022 | Africa | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 21.10.2022 | North Korean state-sponsored hacking group Lazarus gained access to two computers at a financial organisation beginning on 21 October 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2022 | North Korean state-sponsored hacking group Lazarus gained access to the network of a financial organisation in May 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| between May and November 2022 | “No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) | Lazarus Group | |
| 19 May 2022 | Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) | Lazarus Group | |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-02 | Operation “LolZarus” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-06 | ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022 Late | North Korean hackers linked to defense sector supply-chain attack | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-12-01T15:41:19+00:00 (published_time) | Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents | Lazarus Group | |
| 31/03/2022 | Cryptocurrency users and investors. | >1 | Lazarus Group |
| May 10 2022 (dateCreated 2022-05-10) | Mac Protection: New macOS malware 'NukeSped' detected and protected against | Lazarus Group | |
| 2022 | Tornado Cash laundering of Lazarus heist proceeds (largest known heist) | Lazarus Group | |
| In April and May 2022 | Lazarus Group laundering of hacking proceeds through Tornado Cash | Lazarus Group | |
| (2022) | Ronin hack proceeds transmitted through Tornado Cash | Lazarus Group | |
| 04/08/2022 | Employees in the fintech industry | >1 | Lazarus Group |
| 02/02/2023 | Organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university | >1 | Lazarus Group |
| 01.08.2023 | North Korean State-Sponsored Hacker Group Lazarus Exploited Windows Zero-Day Vulnerability in Admin-to-Kernel Operation going back to at least August 2023 | Asia (region);Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean state-sponsored hacking group Labyrinth Chollima gained access to network of unnamed Latin American banking company using QRLOG malware beginning in January 2023 | South America;Central America (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-06 | Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2023-10 | Operation “Dream Magic” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| May 2023 | Targeting of cryptocurrency exchanges in DangerousPassword campaign | Cryptocurrency exchanges in Japan and other countries | Lazarus Group |
| Aug 2023 | Targeting of South Korean defense industry and an electronics manufacturer | South Korean defense conglomerates, universities, and electronics manufacturers | Lazarus Group |
| 29/09/2023 | Undisclosed Spanish aerospace company | ES | Lazarus Group (AKA HIDDEN COBRA) |
| May 9, 2023 (as shown on page; incident March 2022) | Ronin Network (Axie Infinity) bridge theft | Lazarus Group (OFAC listing, April 14th) | |
| May 9, 2023 (as shown on page; incident June 2022) | Harmony Horizon Bridge exploit | Lazarus Group (FBI-confirmed) | |
| 2023-07-27T05:00:00.000Z | More malicious npm packages found in wake of JumpCloud supply chain hack | North Korea; Lazarus Group | |
| 03/08/2023 | IT Professionals | >1 | Lazarus Group |
| February 2023 | Attack on a defence company in Poland | Poland | Lazarus Group |
| 2023 | Malicious packages on the npm package manager | Lazarus Group | |
| first half of 2023 | Attacks targeting China (government, financial, media, education sectors) | China | Lazarus Group; Kimsuky |
| 2023 | Activity in the Russian Federation (“still [has] access to a number of Russian systems”) | Russian Federation | Lazarus Group |
| 9 October 2023 | “Detailed Malware Analysis Report: Putty disguised as malware (Lazarus APT),” Hauri | Lazarus Group | |
| 6 December 2023 | “Analysis of North Korean Hackers’ Targeted Phishing Scams on Telegram,” SlowMist | Lazarus Group | |
| CTA-NK-2023-0622 (report ID; June 2023) | North Korea's Cyber Strategy: 273 cyberattacks attributed to DPRK state-sponsored actors (July 2009 to May 2023) | South Korea; the US | Kimsuky; Lazarus Group; APT37 |
| published 4 Aug 2023 | Snyk Vulnerability Database: Malicious Package in eth-api-node (npm) | Lazarus Group | |
| published 4 Aug 2023 | Snyk Vulnerability Database: Malicious Package in xml2yaml (npm) | Lazarus Group | |
| 05.01.2024 | Lazarus Group suspected of having drained $7.5 million from crypto payment service provider CoinsPaid on 5 January 2024 | Estonia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2024-02 | Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2024-09-10T05:00:00.000Z | Fake recruiter coding tests target devs with malicious Python packages (VMConnect) | Lazarus Group | |
| 2024-11 | Operation “SyncHole” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| September 2024 | Circle froze USDC in three Ethereum wallets belonging to North Korea or the Lazarus Group | North Korea; Lazarus Group | |
| 2024-04-29 (post date) | Lazarus Group laundering of 25+ crypto hacks from 2020-2023 (ZachXBT 15 month investigation) | Lazarus Group | |
| 2024-09-14 (post date) | Stablecoin issuers blacklist Lazarus-related addresses from ZachXBT investigation | Lazarus Group | |
| 2024-02-20T06:00:00.000Z | Lazarus DLL sideloading via IDA Pro library (mentioned in "Attackers leverage PyPI to sideload malicious DLLs") | Lazarus Group | |
| 2024-07-15T00:00:00Z | Hunting Lazarus: Expanding Indicators with Historic DNS (meeting-themed phishing domains) | Lazarus Group (APT38) | |
| 2024-02-28T00:00:00.000Z | Phishing by Appointment: Suspected North Korean Hackers Target Blockchain Community Via Telegram | Lazarus Group (similar tactics) | |
| Q1 2024 (from title: APT Quarterly Highlights : Q1 - 2024) | Lazarus exploitation of Windows kernel vulnerability to enhance FudModule rootkit; Kimsuky PyPI supply chain | APAC region | Lazarus Group; Kimsuky |
| Q2 2024 (from title: APT Quarterly Highlights : Q2 2024) | Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity | South Korea | Kimsuky (Springtail); Moonstone Sleet (Storm-1789); Lazarus Group; Andariel |
| 2024-05-23T19:20:31Z | Beyond espionage — how the Lazarus Group is reshaping cybersecurity threats | Lazarus Group (Hidden Cobra) | |
| 2025-01 | Phemex | Singapore | |
| published 2025-12-04 | Upbit hot wallet breach | South Korea | a North Korean group like the Lazarus Group (believed) |
| 2025-01 | Operation “99” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2025-01 | Operation “Phantom Circuit” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2025-01 | Operation “Marstech Mayhem” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 05/02/2025 | Multiple Organizations | >1 | Lazarus Group |
| 2025-10-16T21:22:16.651Z | Lazarus npm packages (cited in ENISA 2025 Threat Landscape) | Lazarus Group | |
| 2025-07-22T00:00:00Z | Previously unreported domain associated with TraderTraitor Bybit activity (in "Substantial Upgrades to Crawling History") | Lazarus Group (TraderTraitor) | |
| 2025-07-08T10:00:00.000Z | Lazarus Group packages in npm and PyPI (in Q2 2025 Open Source Malware Index) | Lazarus Group | |
| 2025-07-30T10:00:00.000Z | Global Espionage: Lazarus Group Targets OSS Ecosystems | Lazarus Group | |
| 2026-01-06 | Thefts via VSCode runOn: folderOpen | ||
| 2026-06-26 (post date) | AscendEX (Bitmax) hack of December 2021 (reported) | Lazarus Group (reportedly) | |
| 2026-06-27 (post date) | Kelp DAO exploit April 18, 2026 and Humanity Protocol exploit June 9, 2026 funds commingled | Lazarus Group (alleged for Kelp DAO) | |
| 2026-10-05 (article; ZachXBT disclosure October 5) | ZachXBT infiltration of a Chinese laundering syndicate used for Bybit proceeds | Hong Kong / mainland China (per operator's claim) | Lazarus Group; Chinese laundering syndicate |
| (page date not captured; 2026) | Lazarus Group stolen crypto totals; April 2026 KelpDAO and Drift | Lazarus Group | |
| 2026-02-11T16:00:00.000Z | graphalgo fake recruiter campaign targets crypto developers with RAT | Lazarus Group | |
| 21/04/2026 | High-level fintech and cryptocurrency executives and developers using macOS | Global | Lazarus Group (aliases: Hidden Cobra, APT38, Zinc, Labyrinth Chollima) |
| 2026-06-30 | JavaScript build ecosystem / Developers" | Global | Lazarus Group |
| 2026-06-03T21:16:54.000Z | Lazarus Group's Latest: Brandjacking Campaign on npm | Lazarus Group | |
| Q2 2026 (from title: APT QUARTERLY REPORT : APR TO JUN 2026) | Lazarus Group Q2 2026 campaigns against cryptocurrency exchanges, software vendors, defense contractors | Lazarus Group | |
| Not available | North Korean state-integrated hacking group Lazarus gained access to networks of defence and maritime companies | Not available;Not available;Hungary | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| October | Attacks targeting digital asset firms | Lazarus Group | |
| December | AppleJeus Attacks | Lazarus Group | |
| 令和４年１２月２日 (designation date) | Japan asset-freeze designation of Lazarus Group (with crypto addresses) | Lazarus Group (a.k.a. Hidden Cobra; Office 91; Guardians of Peace; ...) | |
| Harmony and Sky Mavis heists laundered via Sinbad (mentioned in OFAC context) | Lazarus Group | ||
| Intrusion at the "Southeast Asian Bank" | Southeast Asia | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" | |
| Spear-phishing and social engineering of South Korean companies and government entities; reconnaissance of U.S. and South Korean military | South Korea | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" | |
| (page date not captured) | North Korean DeFi thefts in 2022 (Ronin and Harmony) | Lazarus Group | |
| April | Targeting Chemical Sector (Operation Dream Job) | Lazarus Group | |
| May | Exploiting Log4Shell Vulnerability (NukeSped) | Lazarus Group | |
| MacOS spear-phishing with fake Coinbase job advertisements targeting fintech developers | Lazarus Group | ||
| September | Amazon-themed campaigns (Dell) | Lazarus Group | |
| September | Three RATs attack | Lazarus Group | |
| Windows rootkit exploiting a Dell firmware driver (CVE-2021-21551), BLINDINGCAN backdoor; target included an aerospace company employee | Lazarus Group | ||
| DLL side-loading attacks and vulnerable driver modules | Lazarus Group | ||
| November | Targeting Ukraine Entities | Lazarus Group | |
| January | 疑似 APT-C-26 （ Lazarus）组织通过 加密货币钱包推广信息 进行攻击活动分析 | Lazarus Group | |
| May | Lazarus Group Targeting Windows IIS Web Servers | Lazarus Group | |
| June | APT-C-26（ Lazarus） 组织使用伪造 VNC 软 件的攻击活动分析 | Lazarus Group | |
| September/ October | lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ Lazarus-campaigns-and-backdoors-in-2022-2023.pdf | Lazarus Group | |
| October | APT trends report Q3 2023 | Securelist | Lazarus Group | |
| October | A Cascade of Compromise: Kaspersky Exposes Lazarus’ New Campaign Exploiting Legitimate Software | Kaspersky | Lazarus Group | |
| November | https://rt-solar.ru/events/news/3851/ | Lazarus Group | |
| December | https://www.koreaherald.com/view.php?ud=20231201000614 | Lazarus Group | |
| December | 疑似 Lazarus（ APT-Q-1）涉及 npm 包供应链 的攻击样本分析 | Lazarus Group | |
| December | https://mp.weixin.qq.com/s/f5YE12w3x3wad5EO0EB53Q https://blog.phylum.io/crypto-themed-npm-packages-found-delivering-stealthy-malware/ | Lazarus Group | |
| Cyberattacks against two German defence companies (fake job offers) | Germany | Lazarus Group | |
| Malicious Python packages (typosquatting) on an open-source Python repository | Lazarus Group | ||
| (no date on page) | How North Korea-Backed Lazarus Group is Weaponizing Open Source to Target Developers (whitepaper landing page) | Lazarus Group | |
| (no date on page) | North Korean ransomware: WannaCry and Maui (in Ransomware as a State-Sponsored Weapon) | UK | Lazarus Group; North Korea |
| (no date on page) | Tracking DangerousPassword Campaign by Lazarus Group | North America; Europe; East Asia | Lazarus Group |
| (no date on page) | NukeSped RAT Report | US; South Korea; Japan; Asia Pacific countries | Lazarus Group (North Korea) |
| (no date on page) | Lazarus Group Recent Trends (13 campaigns observed in 2022) | United States; Japan; Singapore; India; United Kingdom | Lazarus Group |
| (no date on page) | AppleJeus macOS trojan | Lazarus Group |