MITRE ATT&CKgroup

G0032 Lazarus Group

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet
Version
5.0
Created
2017-05-31

Description

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.

Related

Uses · MITRE ATT&CK (120)

  • T1685 Disable or Modify Tools technique
  • T1686.003 Windows Host Firewall sub-technique
  • T1680 Local Storage Discovery technique
  • S1182 MagicRAT software (malware)
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.009 Embedded Payloads sub-technique
  • T1027.007 Dynamic API Resolution sub-technique
  • T1574.013 KernelCallbackTable sub-technique
  • S0665 ThreatNeedle software (malware)
  • T1620 Reflective Code Loading technique
  • S0593 ECCENTRICBANDWAGON software (malware)
  • S0586 TAINTEDSCRIBE software (malware)
  • S0584 AppleJeus software (malware)
  • S0567 Dtrack software (malware)
  • S0520 BLINDINGCAN software (malware)
  • T1589.002 Email Addresses sub-technique
  • T1591 Gather Victim Org Information technique
  • T1583.006 Web Services sub-technique
  • T1584.004 Server sub-technique
  • T1585.001 Social Media Accounts sub-technique
  • T1585.002 Email Accounts sub-technique
  • T1587.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1588.004 Digital Certificates sub-technique
  • T1583.001 Domains sub-technique
  • S0498 Cryptoistic software (malware)
  • S0497 Dacls software (malware)
  • T0865 Spearphishing Attachment technique
  • S0431 HotCroissant software (malware)
  • T1573.001 Symmetric Cryptography sub-technique
Show all 120 ›

Referenced by MITRE ATT&CK · attributed to (1)

  • C0022 Operation Dream Job campaign

References