The only state actor whose primary mission is theft. Stole $1.5 billion from a single exchange in 2025 — the largest heist in history, of any kind.
ATTRIBUTED TONorth Korea › RGB — Reconnaissance General Bureau › Lab 110 / 3rd Bureau
Lazarus Group operates under North Korea's Reconnaissance General Bureau and is unique among state actors in that revenue generation is a core, sanctioned mission rather than a sideline.
The scale is difficult to overstate. UN Panel of Experts reporting has assessed that DPRK cyber operations have generated billions of dollars, with a substantial share directed to the country's weapons programmes. In February 2025 the group stole approximately $1.5 billion in cryptocurrency from the Bybit exchange — the largest theft, by value, ever recorded by any method.
Its history spans the full range of state cyber activity. The 2014 destruction of Sony Pictures Entertainment's network, in retaliation for a film depicting Kim Jong Un's assassination, combined data theft, public leaking, and disk wiping. The 2016 Bangladesh Bank operation abused SWIFT credentials to attempt $951 million in fraudulent transfers, succeeding with $81 million before a spelling error in one instruction — "fandation" for "foundation" — triggered a manual review. WannaCry in May 2017 spread through EternalBlue to over 200,000 machines in 150 countries, disabling substantial parts of the UK's National Health Service.
Its most refined technique is patient social engineering of individual engineers. Operation Dream Job and its successors approach developers at cryptocurrency and defence firms with fabricated recruitment offers, conduct multi-round interviews, and deliver malware inside a "coding assessment" the candidate is asked to run. In the 2023 JumpCloud and 3CX incidents this produced cascading supply-chain compromise — 3CX being the first publicly documented instance of one software supply-chain attack being used to stage another.
The DPRK also runs a parallel programme placing IT workers in remote roles at Western companies under false identities, generating salary revenue and, in some cases, insider access.
Down to the named unit where public evidence supports it.
Also reported as Bureau 121; Chosun Expo Joint Venture used as a front
Attributed to the Reconnaissance General Bureau by U.S. federal indictment. Park Jin Hyok was charged in September 2018 over the Sony, Bangladesh Bank, and WannaCry operations; a February 2021 superseding indictment added Jon Chang Hyok and Kim Il, covering cryptocurrency theft and the fraudulent Marine Chain token scheme. The indictments identify the defendants as RGB members operating in part through the front company Chosun Expo. The U.S. Treasury has sanctioned Lazarus, Bluenoroff, and Andariel as RGB-controlled entities.
Attributing sources
13 designators across 11 organisations.
3 designators are marked partial — the vendor's cluster overlaps this group but is not synonymous with it. Treating a partial correlation as an equivalence is the most common source of attribution error when pivoting between vendor reports.
Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
Weather-event family encodes the attributed origin; the adjective is arbitrary. Renamed from the older element taxonomy (STRONTIUM, NOBELIUM, HAFNIUM) in April 2023. 'Storm-####' is a temporary designator for a cluster still in development.
Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
Constellation denotes attributed origin or motive, adopted in 2023 to replace ad-hoc naming.
Colour prefix encodes attributed origin (RedXxxx = China, BlueXxxx = Russia). TAG-## ('Threat Activity Group') is a provisional designator for clusters pending attribution.
Descriptive names, frequently derived from the group's flagship malware family.
Descriptive names, often coined from a distinctive string or artifact in the toolset.
Insect, animal, and plant names assigned in the order clusters were first identified.
U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.
Target sectors
Target geography
Custom tooling is a strong clustering signal; shared and commodity tooling is not.
Custom / bespoke
Worm-propagating ransomware using EternalBlue; hit 200,000+ machines across 150 countries in May 2017.
Malpedia ↗Trojanised cryptocurrency trading applications distributed through convincing fake company websites, with macOS and Windows builds.
Malpedia ↗Fabricated recruitment processes at real defence and crypto firms, delivering malware inside a 'coding assessment'.
Qt-framework backdoors whose large legitimate library footprint frustrates static analysis.
Backdoor used against defence and aerospace contractors, documented in a CISA advisory.
Malpedia ↗Malicious npm packages and trojanised trading applications targeting blockchain engineers.
Kernel rootkit that disables EDR from kernel space via a bring-your-own-vulnerable-driver technique.
Shared, commodity & living-off-the-land
Cryptocurrency mixing services used to launder stolen funds; sanctioned by OFAC in August 2022.
Filtered on the date this actor was first reported exploiting the flaw — not the CVE's publication date.
| CVE | Product | Usage by Lazarus Group | ||
|---|---|---|---|---|
| CVE-2024-214120-dayKEVransomware | 8.1 | Windows SmartScreenMicrosoft | 1 Jan 2024 | Windows SmartScreen bypass exploited as a zero-day to deliver payloads without Mark-of-the-Web warnings.SRCTrend Micro ↗ |
| CVE-2023-42793KEVransomware | 9.8 | JetBrains TeamCityJetBrains | 1 Oct 2023 | JetBrains TeamCity RCE exploited for access to software build pipelines, enabling supply-chain positioning.SRCMicrosoft Threat Intelligence ↗ |
| CVE-2021-44228KEVransomware | 10.0 | Apache Log4j2Apache | 1 Feb 2022 | Log4Shell exploited against internet-facing VMware Horizon servers for initial access to enterprise networks.SRCCisco Talos ↗ |
| CVE-2018-48780-dayKEVransomware | 9.8 | Adobe Flash PlayerAdobe | 31 Jan 2018 | Adobe Flash use-after-free exploited as a zero-day against South Korean targets before Adobe issued a patch.SRCKrCERT / Cisco Talos ↗ |
| CVE-2017-0144KEVransomware | 8.1 | Windows SMBv1Microsoft | 12 May 2017 | EternalBlue built into WannaCry's propagation engine, producing worm-speed spread across 150 countries within hours and disabling a substantial part of the UK National Health Service.SRCNCSC-UK ↗ |
Actors sharing exploited CVEs
How this actor moves through an intrusion, stage by stage, titled by ATT&CK tactic. Read left to right.
2 techniques
Builds companies that do not exist. Fabricated recruitment firms and cryptocurrency trading brands get real websites, staff pages, product documentation and code-signing certificates — enough that a target performing ordinary due diligence finds nothing wrong.
2 techniques
Approaches individual engineers, not organisations. A recruiter contacts a developer at a crypto or defence firm on LinkedIn, conducts several rounds of genuine-seeming interviews, and delivers the payload inside a coding assessment the candidate is asked to run locally. Where that is too slow, a compromised software vendor does it at scale.
1 technique
The target executes it themselves — a take-home exercise, a trading application, an npm dependency. No exploit is required when the victim has been persuaded the file is their job.
1 technique
Brings a vulnerable signed driver and uses it to reach kernel space, from which FudModule disables the endpoint agent that would otherwise be watching.
2 techniques
Stolen and fraudulently obtained code-signing certificates, and a Qt-framework implant whose enormous legitimate library footprint buries the malicious fraction in static analysis.
3 techniques
Revenue, at state scale. SWIFT transaction manipulation with the printed confirmations suppressed, ATM switch servers approving fraudulent withdrawals, exchange signing interfaces altered so authorised approvers unknowingly sign the theft — $1.5 billion from Bybit in a single operation. Where destruction serves instead, WannaCry and the Sony wiper.
Scroll horizontally · characteristic chain across documented operations, not a single incident
Grouped in kill-chain order.
Fully fabricated company websites with staff pages and product documentation
LinkedIn and WhatsApp recruitment approaches to individual engineers
3CX and JumpCloud — the first documented chained supply-chain compromise
Coding assessments and trading applications run voluntarily by the target
Bring-your-own-vulnerable-driver to reach kernel and disable EDR
Stolen and fraudulently obtained certificates
SWIFT fraud, exchange compromise, and direct wallet theft
WannaCry, and Maui ransomware against U.S. healthcare
Sony Pictures wiper component
Theft of approximately $1.5 billion in cryptocurrency from the Bybit exchange through compromise of a wallet infrastructure provider and manipulation of a multi-signature transaction interface — the largest theft by value ever recorded, by any method.
Trojanised 3CX desktop application distributed to a customer base of over 600,000 organisations. The intrusion originated from a prior supply-chain compromise of Trading Technologies' X_TRADER software — the first publicly documented case of one software supply-chain attack being used to stage another.
Worm-propagating ransomware using EternalBlue, infecting over 200,000 machines across 150 countries in days. The UK's National Health Service was severely disrupted, with roughly 19,000 appointments cancelled. Spread was halted by the registration of a hardcoded kill-switch domain.
Abuse of SWIFT credentials to attempt $951 million in fraudulent transfers from Bangladesh Bank's account at the Federal Reserve Bank of New York. $81 million was successfully moved before a misspelling — 'fandation' for 'foundation' — triggered manual review of the remaining instructions.
Destruction of Sony Pictures' network alongside theft and public release of unreleased films, employee personal data, and internal email, in retaliation for a film depicting the assassination of Kim Jong Un. The first major destructive attack on a U.S. company attributed to a state.
Relationship type and confidence stated explicitly — 'related' without qualification is not an assessment.
APT38 is the financially motivated element operating under the same RGB structure; vendors differ on whether to treat it as distinct or as a Lazarus subgroup.
Both RGB; Treasury sanctioned Lazarus, Bluenoroff, and Andariel together in September 2019 as RGB-controlled entities.
Both RGB, with different missions — Kimsuky collects intelligence, Lazarus generates revenue.
Both DPRK state actors; APT37 is assessed as MSS-aligned rather than RGB.
Curated links to the reports that established what is known about this group.