DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Lazarus turns against Russia

Date (as written)
01.01.2019
Year
2019
Country
Russia
Actors (as written)
Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
Actor pages
Lazarus GroupLabyrinth ChollimaHIDDEN COBRAGuardians of PeaceDiamond Sleet fka ZINCNICKEL ACADEMYNewRomanic Cyber Army TeamWhois Hacking TeamApplewormGroup 77G0032Lazarus
Tags (as written)
Data theft;Hijacking with Misuse

Source entries (4)

CSIS Significant Cyber Incidents

CSIS entry 754 · February 2019
A hacking campaign targeted Russian companies linked to state-sponsored North Korean hackers.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

EuRepoC

Lazarus turns against Russia · 01.01.2019
The north-Korean APT attacked Russian companies with previously used tools
https://research.checkpoint.com/2019/north-korea-turns-against-russian-targets/

Check Point Research

North Korea Turns Against New Targets?! · 2019-02-19
Over the past few weeks, we have been monitoring suspicious activity directed against Russian-based companies that exposed a predator-prey relationship that we had not seen before. For the first time we were observing what seemed to be a coordinated North Korean attack against Russian entities. While attributing attacks to a certain threat group or another is problematic, the analysis below reveals intrinsic connections to the tactics, techniques and tools used by the North Korean APT group – Lazarus.
https://research.checkpoint.com/2019/north-korea-turns-against-russian-targets/

Hackmageddon cyber attacks timelines (Paolo Passeri)

Russian-based companies · 19/02/2019
Researchers from Check Point reveal the details of the latest campaign carried out by the Lazarus Group, targeting Russian-based organizations.
https://www.hackmageddon.com/2019/03/20/16-28-february-2019-cyber-attacks-timeline/
https://www.bleepingcomputer.com/news/security/north-korean-apt-lazarus-targets-russian-entities-with-keymarble-backdoor/

Values found later for empty fields

country: Russian
A hacking campaign targeted Russian companies linked to state-sponsored North Korean hackers.
https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm
actors: Lazarus
the analysis below reveals intrinsic connections to the tactics, techniques and tools used by the North Korean APT group – Lazarus.
https://research.checkpoint.com/2019/north-korea-turns-against-russian-targets/

Suggest a correction on GitHub