DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Lazarus: Three North Koreans Charged for Financially Motivated Attacks

Date (as written)
18 Feb 2021
Year
2020
Actor pages
Lazarus Group and Advanced Persistent Threat 38
Dollar figures (as written)
$1.3 billion; $11,800,000; 11.8m; $11.8 million; approximately $1.9 million; $1.9 million

Source entries (9)

lazarus.day

New York Financial Services Company · 2020-08
The U.S. Justice Department indictment described North Korean RGB-linked programmers, associated in security reporting with Lazarus Group and APT38, as conducting a long-running conspiracy involving destructive attacks, financial theft, extortion, and cryptocurrency operations. The charged activity included targeting cryptocurrency companies and thefts from Slovenian, Indonesian, and New York financial or crypto entities, alongside malicious cryptocurrency applications used as backdoors.
https://lazarus.day/incidents/nyfsc/

CSIS Significant Cyber Incidents

CSIS entry 507 · February 2021
The US Department of Justice indicted three North Korean hackers for conspiring to steal and extort more than $1.3 billion in cash and cryptocurrencies.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

tayvano/lazarus-bluenoroff-research

New York Financial Services Company · 2020-08-07
Amt Stolen: $11,800,000
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/new_york_financial_services_company.md

UN Panel of Experts S/2024/215

[financial services company] · 7 August 2020
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2020: Victim: [financial services company]; Date: 7 August; Amount (USD equivalent): 11.8m; Location: U.S.
https://undocs.org/S/2024/215

US DOJ press release 2021-02-17 (Jon Chang Hyok, Kim Il, Park Jin Hyok indictment)

Financial services company in New York (CryptoNeuro Trader backdoor) · August 2020
... and $11.8 million from a financial services company in New York in August 2020 in which the hackers used the malicious CryptoNeuro Trader application as a backdoor. ... The seizures include sums of multiple cryptocurrencies totaling approximately $1.9 million, which will ultimately be returned to the victim.
https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

New York Financial Services Company · 2020-08
Reported: 2020-08; Victims: New York Financial Services Company; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: United States
https://data.mendeley.com/datasets/wwb2rzgfn7/2

US Department of Justice press releases

Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe · 2021-02-17 (press release date)
A federal indictment unsealed today charges three North Korean computer programmers with participating in a wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks, to steal and extort more than $1.3 billion of money and cryptocurrency from financial institutions and companies, to create and deploy multiple malicious cryptocurrency applications, and to develop and fraudulently market a blockchain platform.
https://www.justice.gov/archives/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

Boannews 보안뉴스 (boannews.com)

미국 사법부, 북한 정찰총국 소속 해커 3명 실명 기소 · 2021-02-18
attribution sentence(s): 북한 해커 세 명의 실명이 미국 사법부 문건을 통해 정식으로 공개됐다. | 이들은 암호화폐 거래소와 은행 등을 공격해 13억 달러를 북한 국고에 추가했고, 북한은 이 돈을 핵 개발 프로그램에 투자했다고 한다. | [보안뉴스 문가용 기자] 미국 사법부가 북한 정찰총국 소속 해커 세 명을 기소했다.
https://m.boannews.com/html/detail.html?idx=95014

Symantec / Broadcom Threat Hunter Team (security.com)

Lazarus: Three North Koreans Charged for Financially Motivated Attacks · 18 Feb 2021
More than $1.3 billion stolen in string of attacks against financial institutions and cryptocurrency exchanges.
https://www.security.com/threat-intelligence/lazarus-north-korea-indictment

Values found later for empty fields

country: Vietnam, Bangladesh, Taiwan, Mexico, Malta, and Africa (bank heists); victims also in the United States
Attempts from 2015 through 2019 to steal more than $1.2 billion from banks in Vietnam, Bangladesh, Taiwan, Mexico, Malta, and Africa by hacking the banks' computer networks
https://www.justice.gov/archives/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and
country: Bangladesh, Malta, Mexico, Indonesia, Pakistan, the Philippines, Poland, the Republic of Korea, Slovenia, Taiwan, the United Kingdom, Vietnam, Central America, and Africa -- as well as in the United States
around the world -- including in Bangladesh, Malta, Mexico, Indonesia, Pakistan, the Philippines, Poland, the Republic of Korea, Slovenia, Taiwan, the United Kingdom, Vietnam, Central America, and Africa -- as well as in the United States
https://www.justice.gov/opa/press-release/file/1367701/download
actors: Lazarus Group and Advanced Persistent Threat 38 (APT38)
These North Korean military hacking units are known by multiple names in the cybersecurity community, including Lazarus Group and Advanced Persistent Threat 38 (APT38).
https://www.justice.gov/archives/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

Suggest a correction on GitHub