Actors/Nation-state / APT/Asia

Lazarus Group

G0032APTKP · North Korea

AKA HIDDEN COBRA · Diamond Sleet · NewRomanic Cyber Army Team · Appleworm · WHOis Team · Guardians of Peace · Dark Seoul · Operation Troy · Bureau 121 · NICKEL ACADEMY · Whois Hacking Team · Subgroup: Bluenoroff · Subgroup: Andariel · COVELLITE · ATK3

Microsoft: ZincCrowdStrike: Labyrinth ChollimaESET: LazarusMandiant: APT38MITRE: G0032Proofpoint: TA404Secureworks: IRON HIGHLAND

DPRK RGB cyber unit responsible for high-impact financial heists and espionage.

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2009

Also tracked as

8 vendor names · 15 other aliases

Open Rosetta Stone

CrowdStrike

Labyrinth Chollima

ESET

Lazarus

Kaspersky

Lazarus Group

Mandiant

APT38

Microsoft

Zinc

MITRE

G0032

Proofpoint

TA404

Secureworks

IRON HIGHLAND

UNATTRIBUTED ALIASESHIDDEN COBRADiamond SleetNewRomanic Cyber Army TeamApplewormWHOis TeamGuardians of PeaceDark SeoulOperation TroyBureau 121NICKEL ACADEMYWhois Hacking TeamSubgroup: BluenoroffSubgroup: AndarielCOVELLITEATK3

Victimology

Geographic footprint · 25 countries

origin · North Koreatargeted countries · 25

ASIA · 7

Bangladesh · Hong Kong · Indonesia · India · Lebanon · Thailand · Vietnam

AMERICAS · 8

Brazil · Chile · Colombia · Ecuador · Guatemala · Mexico · Uruguay · Venezuela

EUROPE · 7

Belarus · Czechia · Germany · Spain · United Kingdom · Poland · Russia

AFRICA · 3

Liberia · Tunisia · South Africa

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Cryptocurrency21 actors Pharmaceutical27 actors Technology60 actors Telecom72 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Transportation31 actors Hospitality33 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Consumer Goods / Electronics20 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · EspionageFIN · Financial Fraud

MITRE ATT&CK · 67 techniques

Reconnaissance · 2

T1589.002Email Addresses T1591Gather Victim Org Information

Resource Development · 1

T1583.006Web Services

Initial Access · 4

T1189Drive-by Compromise

Execution · 7

T1047Windows Management Instrumentation

Persistence · 4

T1098Account Manipulation

Credential Access · 1

T1557.001Name Resolution Poisoning and SMB Relay

Discovery · 10

T1010Application Window Discovery T1012Query Registry

Lateral Movement · 3

T1021.001Remote Desktop Protocol T1021.002

Collection · 4

T1005Data from Local System T1560Archive Collected Data T1560.002Archive via Library

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Impact · 5

T1485Data Destruction

Command And Control · 8

T1001.003Protocol or Service Impersonation T1008Fallback Channels T1071.001Web Protocols

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 15

T1027.007Dynamic API Resolution T1036.003

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer67 techniques · layer format 4.5

Related actors

By origin and actor type

T1566.001

Spearphishing Attachment

T1566.002Spearphishing Link

T1566.003Spearphishing via Service

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1106Native API

T1203Exploitation for Client Execution

T1543.003

Windows Service

T1547.001Registry Run Keys / Startup Folder

T1547.009Shortcut Modification

T1016

System Network Configuration Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1124System Time Discovery

T1680Local Storage Discovery

SMB/Windows Admin Shares

T1021.004SSH

T1560.003

Archive via Custom Method

T1489

Service Stop

T1529System Shutdown/Reboot

T1561.001Disk Content Wipe

T1561.002Disk Structure Wipe

T1090.001

Internal Proxy

T1102.002Bidirectional Communication

T1104Multi-Stage Channels

T1105Ingress Tool Transfer

T1571Non-Standard Port

Rename Legitimate Utilities

T1036.004Masquerade Task or Service

T1036.005Match Legitimate Resource Name or Location

T1055.001Dynamic-link Library Injection

T1070Indicator Removal

T1070.004File Deletion

T1078Valid Accounts

T1140Deobfuscate/Decode Files or Information

T1202Indirect Command Execution

T1218System Binary Proxy Execution

T1218.005Mshta

T1218.011Rundll32

T1564.001Hidden Files and Directories

T1620Reflective Code Loading