Lazarus Group

Lazarus Group (Hidden Cobra, Diamond Sleet, Labyrinth Chollima) — Adversary Emulation Profile

Lazarus Group (MITRE ATT&CK G0032) is a North Korean state-sponsored threat actor active since at least 2009 and attributed by the U.S. Government and the security industry to the DPRK's Reconnaissance General Bureau (RGB). It is one of the most versatile and prolific nation-state actors observed, running three overlapping mission types in parallel: strategic espionage, destructive/disruptive attacks (e.g., the 2014 Sony Pictures wiper and the 2017 WannaCry outbreak), and large-scale financially motivated theft to fund the sanctioned regime (SWIFT bank fraud, ATM "FASTCash" cash-outs, and cryptocurrency heists). MITRE and vendors track several clusters/aliases under or alongside the Lazarus umbrella — HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet (Microsoft), and Labyrinth Chollima (CrowdStrike) — with financial sub-clusters often labeled APT38 / BlueNoroff / Stardust Chollima. The group blends bespoke malware, trojanized legitimate software, supply-chain compromise, and elaborate social engineering (fake recruiter "job offers") to reach hardened targets.

Attribution & motivation

• Suspected sponsor / nation: North Korea (DPRK), tied to the Reconnaissance General Bureau (RGB). The U.S. Government uses the umbrella name HIDDEN COBRA for DPRK malicious cyber activity.
• Motivation (mixed):
  • Financial — sanctions-driven revenue generation: SWIFT interbank fraud, FASTCash ATM cash-outs, and cryptocurrency theft from exchanges, DeFi, and blockchain firms.
  • Espionage — collection against defense, aerospace, government, and crypto/fintech targets, frequently via fake-job-offer lures (Operation Dream Job).
  • Destructive / disruptive — wiper and ransomware operations (Sony Pictures 2014; WannaCry 2017).
• Confidence of attribution: High. Backed by a 2018 U.S. DOJ criminal complaint naming DPRK programmer Park Jin Hyok, multiple joint FBI/CISA/Treasury/USCYBERCOM advisories, and corroborating Mandiant/ESET/Kaspersky/Microsoft reporting. Individual sub-cluster boundaries (Lazarus vs. APT38/BlueNoroff) carry moderate analyst-to-analyst variance.

Targeting

• Sectors: financial services and banks (SWIFT endpoints, ATM switch infrastructure), cryptocurrency exchanges / blockchain / DeFi / Web3 and crypto-related software, defense and aerospace, government, media/entertainment, energy, gaming, and IT/DevOps personnel at high-value firms.
• Regions: global. Heavy activity against the United States, South Korea, Japan, and Europe, with bank-fraud operations reaching South/Southeast Asia, Africa, and Latin America.
• Victim profile: organizations holding liquid value or strategic data, and individual employees — especially software developers, DevOps, system administrators, and crypto/financial staff who are approached with tailored recruiter or business-development lures on LinkedIn, Telegram, Discord, and email.

Notable campaigns

• 2014-11 — Sony Pictures Entertainment (Guardians of Peace): destructive wiper intrusion that destroyed data and leaked internal material; one of the events that established the group's destructive capability. (DOJ complaint; MITRE G0032)
• 2016-02 — Bangladesh Bank SWIFT heist: spearphishing-led network compromise of SWIFT-connected terminals; fraudulent SWIFT instructions attempted ~US$1B, with US$81M successfully transferred before the rest was blocked. (CISA AA20-239A; DOJ complaint)
• 2017-05 — WannaCry 2.0: self-propagating ransomware (leveraging the EternalBlue SMB exploit) that hit hundreds of thousands of systems globally, including the UK NHS. (DOJ complaint)
• 2018-06 — DOJ complaint unsealed (Park Jin Hyok): U.S. charges link Lazarus to Sony, Bangladesh Bank, and WannaCry, attributing the activity to a DPRK government front company. (DOJ press release)
• 2018-10 — FASTCash ATM cash-out (TA18-275A): malware on bank payment-switch application servers manipulates ISO 8583 messages to authorize fraudulent ATM withdrawals across many countries simultaneously. (CISA TA18-275A)
• 2020-08 — FASTCash 2.0 / "BeagleBoyz" (AA20-239A): expanded ATM cash-out tradecraft and bank targeting; advisory notes attempts to steal nearly US$2B since 2015. (CISA AA20-239A)
• 2020-onward — Operation Dream Job: fake job-offer social engineering against defense, aerospace, and crypto targets delivering custom implants (e.g., DRATzarus); flagship lure framework reused across later operations. (ESET; MITRE)
• 2021-02 — AppleJeus (AA21-048A): trojanized cryptocurrency trading applications backdoor victims to steal crypto from individuals and exchanges. (CISA AA21-048A)
• 2022-04 — TraderTraitor (AA22-108A): FBI/CISA/Treasury advisory on spearphishing of crypto/blockchain employees (admins, devs, DevOps) with trojanized crypto apps to steal keys and funds. (CISA AA22-108A)
• 2023-03 — 3CX double supply-chain compromise: trojanized 3CXDesktopApp installer pushed second-stage malware; Mandiant assessed initial access came from a prior supply-chain compromise of the X_TRADER application (VEILEDSIGNAL backdoor), making it the first observed cascading software supply-chain attack; ESET/Kaspersky linked artifacts to Operation Dream Job and AppleJeus. (Mandiant; ESET)

TTPs by ATT&CK tactic

(Technique IDs verified against MITRE ATT&CK G0032.)

Initial Access

• T1566.001 / .002 / .003 (Phishing — Attachment / Link / via Service): spearphishing with malicious documents, links, and social-platform messages (LinkedIn, Telegram, Discord, WhatsApp), commonly themed as recruiter/job offers.
• T1189 (Drive-by Compromise): watering-hole and strategic-web compromises to deliver implants.
• T1078 (Valid Accounts): uses stolen/legitimate credentials for access and to blend in.
• T1204.001 / .002 (User Execution — Malicious Link / File): relies on the lured employee opening a weaponized doc or running a trojanized app.

Execution

• T1059.001 / .003 / .005 (PowerShell / Windows Command Shell / Visual Basic): scripted loaders and post-exploitation.
• T1106 (Native API), T1203 (Exploitation for Client Execution), T1221 (Template Injection): API-based execution, document-exploit delivery, and remote-template fetch.
• T1047 (WMI), T1053.005 (Scheduled Task), T1218.005/.010/.011 (Mshta / Regsvr32 / Rundll32), T1220 (XSL Script Processing): proxied/native execution to run payloads and tasks.

Persistence

• T1547.001 / .009 (Registry Run Keys/Startup Folder / Shortcut Modification): autostart implants.
• T1543.003 (Windows Service): installs services for persistent execution.
• T1542.003 (Bootkit): pre-OS persistence in select destructive/espionage tooling.
• T1505.004 (Server Software Component — IIS Components): web-server-resident persistence/backdoors.

Privilege Escalation

• T1134.002 (Create Process with Token): token manipulation to run as another user.
• T1548.002 (Bypass UAC): elevation on Windows hosts.

Defense Evasion

• T1574.001 (DLL Side-Loading): plants malicious DLLs next to signed binaries (a Lazarus signature, used in 3CX-era tooling).
• T1553.002 (Code Signing) + T1587.001/T1588.003 (Develop/Obtain Code-Signing Certs): signs malware with stolen or acquired certificates.
• T1027.002 / .007 / .009 (Software Packing / Dynamic API Resolution / Embedded Payloads), T1140 (Deobfuscate/Decode), T1620 (Reflective Code Loading): packed, encoded, in-memory payloads.
• T1036.004 / .005 (Masquerade Task or Service / Match Legitimate Name or Location), T1564.001 (Hidden Files): disguises artifacts as legitimate software.
• T1070.003 / .004 / .006 (Clear Command History / File Deletion / Timestomp), T1197 (BITS Jobs), T1622 (Debugger Evasion): cleanup and stealth.
• T1497.001 / .003 (Sandbox System Checks / Time-Based Checks): anti-analysis/anti-VM logic.

Credential Access

• T1056.001 (Keylogging): captures credentials and keystrokes.
• T1110.003 (Password Spraying): credential guessing against exposed services.
• T1557.001 (LLMNR/NBT-NS Poisoning & SMB Relay): uses Responder-style poisoning to capture/relay hashes.

Discovery

• T1087.002 (Domain Account Discovery), T1082 (System Info), T1083 (File/Directory), T1057 (Process), T1012 (Query Registry), T1018 (Remote System), T1016/T1049 (Network Config/Connections), T1033 (System Owner/User), T1124 (System Time), T1614.001 (System Language), T1010 (App Window), T1046 (Network Service Scanning): broad host/network enumeration to orient before lateral movement and to fingerprint (e.g., language checks to avoid certain locales).

Lateral Movement

• T1021.001 / .002 / .004 (RDP / SMB-Admin Shares / SSH): moves between hosts using remote services.
• T1098 (Account Manipulation): modifies accounts to maintain access.

Collection

• T1119 (Automated Collection), T1005 (Data from Local System), T1074.001 (Local Data Staging): harvests and stages target data locally.
• T1560.001 / .003 (Archive via Utility / Custom Method): compresses/encrypts data before exfil.
• T1056.001 (Keylogging): also serves collection.

Command & Control

• T1071.001 (Web Protocols), T1102.002 (Bidirectional Web Service), T1573.001 (Symmetric Encrypted Channel), T1008 (Fallback Channels), T1104 (Multi-Stage Channels), T1571 (Non-Standard Port), T1090.001/.002 (Internal/External Proxy), T1105 (Ingress Tool Transfer): HTTP(S)-based, encrypted, multi-stage C2 with proxies and fallback infrastructure.

Exfiltration

• T1041 (Exfiltration Over C2 Channel), T1567.002 (Exfil to Cloud Storage), T1048.003 (Exfil Over Unencrypted Non-C2 Protocol): routes stolen data out via C2, cloud services, or alternate protocols.

Impact

• T1485 (Data Destruction), T1561.001 / .002 (Disk Content / Structure Wipe), T1489 (Service Stop), T1529 (System Shutdown/Reboot), T1491.001 (Internal Defacement): destructive operations (Sony-style wipers, WannaCry-class disruption).

Signature tooling & malware

(IDs from MITRE ATT&CK Software associated with G0032; "custom" = DPRK-developed, "public" = commodity/open tool.)

• AppleJeus (S0584) — custom: trojanized cryptocurrency-trading apps for crypto theft (CISA AA21-048A).
• DRATzarus (S0694) — custom: RAT delivered via Operation Dream Job fake-job lures.
• BLINDINGCAN (S0520) — custom: full-featured RAT (CISA-reported).
• Bankshot (S0239) / BADCALL (S0245) / AuditCred (S0347) — custom: implants/backdoors.
• Dtrack (S0567) — custom: spyware/backdoor used in financial and infrastructure intrusions.
• Dacls (S0497) — custom: cross-platform (Windows/Linux/macOS) RAT.
• Cryptoistic (S0498) — custom: macOS/Swift backdoor used in crypto operations.
• Torisma (S0678) — custom: implant used in Operation Dream Job-style targeting.
• ECCENTRICBANDWAGON (S0593) — custom: keylogger/screenshot collector.
• Responder (S0174) — public: LLMNR/NBT-NS poisoning & SMB-relay credential capture.
• Additional widely reported families (not all in the G0032 software list): WannaCry ransomware, FASTCash ATM-switch malware (ISO 8583 manipulation), and the 3CX-era VEILEDSIGNAL / Gopuram tooling — custom. Validate any of these against current primary reporting before citing in a deliverable.

Emulation guidance (Decepticon)

Authorized use only. Execute these emulations exclusively inside the signed rules-of-engagement and scope of the current engagement. Never touch out-of-scope assets, never deploy genuinely destructive payloads against production, and use benign, instrumented stand-ins for any wiper/ransomware behavior.

Map Lazarus signature TTPs to Decepticon capabilities to reproduce the actor's behavior chain for the blue cell:

• Initial access — fake-job-offer social engineering (T1566.001/.002/.003, T1204): stage a recruiter-themed lure (LinkedIn/Telegram/email) delivering a benign tracked document or "trial app." Use the phishing/social-engineering workflow; deliver a marked payload (beacon-only) rather than live malware. Capture which employees execute (DevOps/admin/dev personas mirror real targeting).
• Trojanized app / supply-chain feel (T1189, T1204.002): with explicit approval, host a signed-looking "installer" on in-scope infrastructure that drops the C2 stager — emulate AppleJeus/3CX delivery without redistributing real malware.
• C2 — encrypted multi-stage HTTPS beacon (T1071.001, T1573.001, T1104, T1008, T1090): deploy Sliver (c2/sliver skill) with HTTPS/mTLS profiles, jitter, fallback listeners, and a redirector/proxy to mirror Lazarus's encrypted, multi-stage, proxied C2.
• Execution & persistence (T1059.001/.003, T1053.005, T1547.001, T1543.003): via the bash/command-execution and host tooling, register a Scheduled Task and a Run key / Windows service for autostart persistence on the implanted host.
• Defense evasion (T1574.001 DLL side-loading, T1553.002 code signing, T1027 packing, T1620 reflective loading): use the defense-evasion skill to build a side-loading scenario next to a signed binary, sign payloads with a test cert, and load in-memory — exercising the EDR's side-load and unsigned-memory-module detections.
• Credential access (T1557.001, T1110.003, T1056.001): run Responder-style LLMNR/NBT-NS poisoning + SMB relay, scoped password spraying, and a benign keylogger to test credential-capture detections.
• Discovery + lateral movement (T1087.002, T1018, T1046, T1021.001/.002/.004, T1078): chain the AD and lateral-movement skills — enumerate domain accounts/hosts, then pivot via RDP/SMB/SSH using captured/seeded valid accounts.
• Collection & exfil (T1560, T1074.001, T1041, T1567.002): stage and archive marked "sensitive" canary data locally, then exfiltrate over the Sliver C2 channel and to an in-scope cloud storage bucket to validate DLP/egress monitoring.
• Impact (emulated only) (T1485/T1561/T1489): do not run real wipers. Use a controlled, reversible marker (touch a flagged file / stop a non-critical test service in a lab segment) so the blue cell can validate destructive-action and service-stop alerting without data loss.

Detection & defense

• Social-engineering / lure hygiene: train high-value staff (devs, DevOps, admins, crypto/finance) on unsolicited recruiter "coding test" / "trading app" lures; restrict execution of files arriving via personal chat platforms; mark and sandbox inbound documents (counters T1566.*, T1204).
• Supply-chain & code signing: monitor for unexpected child processes spawned by signed installers/updaters; alert on DLL side-loading (signed binary loading an unsigned/mislocated DLL) and on newly trusted code-signing certs (counters T1574.001, T1553.002).
• Execution telemetry: flag PowerShell/WScript, mshta/regsvr32/rundll32 proxy execution, WMI process creation, and new Scheduled Tasks/Services with masqueraded names (counters T1059, T1218, T1047, T1053.005, T1036.004).
• Credential defenses: disable LLMNR/NBT-NS and require SMB signing to defeat Responder-style relay; alert on password spraying and unexpected keystroke/hook drivers (counters T1557.001, T1110.003, T1056.001).
• Lateral movement: monitor RDP/SMB/SSH from non-admin hosts and anomalous valid-account use; segment SWIFT/payment-switch and ATM-controller networks and tightly monitor ISO 8583 message integrity for FASTCash-style fraud (counters T1021.*, T1078).
• C2 / exfil: inspect TLS for anomalous JA3/beacon cadence on non-standard ports, alert on traffic to newly registered domains and unsanctioned cloud-storage egress; enforce DLP on archived/staged data (counters T1071.001, T1573.001, T1571, T1567.002, T1041).
• Anti-destruction: maintain offline, tested backups and protect MBR/VBR; alert on mass file overwrite/deletion, vssadmin/shadow-copy tampering, and unexpected service-stop or shutdown commands (counters T1485, T1561, T1489, T1529).
• Persistence audits: baseline and monitor Run keys, startup shortcuts, services, scheduled tasks, and IIS module installs; alert on bootkit-level disk changes (counters T1547, T1543.003, T1505.004, T1542.003).

Sources

• MITRE ATT&CK — Lazarus Group (G0032): https://attack.mitre.org/groups/G0032/
• CISA AA22-108A — TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a
• CISA AA21-048A — AppleJeus: Analysis of North Korea's Cryptocurrency Malware: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-048a
• CISA AA20-239A — FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a
• CISA TA18-275A — HIDDEN COBRA – FASTCash Campaign: https://us-cert.cisa.gov/ncas/alerts/TA18-275A
• U.S. DOJ — North Korean Regime-Backed Programmer Charged (Park Jin Hyok complaint): https://www.justice.gov/archives/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
• Mandiant (Google Cloud) — 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise
• ESET WeLiveSecurity — Linux malware strengthens links between Lazarus and the 3CX supply-chain attack: https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/