lazarusholic

Everyday is lazarus.dayβ

BlueNoroff

Lazarus Under The Hood

2017-04-03, Kaspersky
Lazarus Under The Hood
"A subgroup of Lazarus Group, Hidden Cobra, Labyrinth Chollima."

- ETDA, https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a979f6ac-99b3-4810-9362-94187db06784
"Bluenoroff Threat Actor Intelligence Profile"

- Cybergeist, https://cybergeist.io/profile/bluenoroff

Also known as

 
Name Named by AKA First seen Last seen
APT38 Mandiant BlueNoroff 2018-10-03 2025-11-14
ATK117 ThalesGroup APT38 2019-10-07 2022-05-31
AlluringPisces PaloaltoNetworks BlueNoroff 2024-09-09 2025-02-26
BeagleBoyz USCISA BlueNoroff 2020-08-26 2021-03-04
BlackAlicanto PWC CryptoCore 2021-09-08 2023-04-12
BlackDev2 PWC BlueNoroff 2021-09-08 2023-04-12
BlueNoroff Kaspersky - 2017-04-03 2026-04-27
CTG-6459 SecureWorks NickelGladstone - -
Copernicium Microsoft APT38 2022-11-07 2022-11-07
CryptoCore Clearskysec BlueNoroff 2020-06-24 2025-10-22
CryptoMimic NTTSecurity CryptoCore 2020-09-30 2021-02-01
DarkRiver Ptsecurity JadeSleet 2023-09-27 2023-09-27
G0082 MITRE APT38 2019-01-29 2019-01-29
JINX-0164 Wiz SapphireSleet 2026-05-27 2026-05-27
JadeSleet Microsoft TraderTraitor 2023-07-18 2024-10-15
LeeryTurtle Cyberstruggle CryptoCore - 2020-05-06
MASAN Google UNC1069 2025-11-06 2025-11-05
NickelGladstone SecureWorks BlueNoroff - 2023-03-18
PUKCHONG Google UNC4899 2024-06-12 2025-11-05
PressureChollima CrowdStrike JadeSleet 2026-01-29 2026-05-14
PutridSlug Cloudflare BlueNoroff 2026-03-03 2026-03-03
REF9135 Elastic BlueNoroff 2023-06-29 2023-06-29
RedCarpet KRCERT BlueNoroff - -
SapphireSleet Microsoft Copernicium 2023-04-19 2026-05-28
SectorA06 NSHC BlueNoroff 2020-03-12 2025-02-11
SlowPisces PaloaltoNetworks JadeSleet 2024-06-28 2025-04-14
StardustChollima CrowdStrike BlueNoroff 2018-02-26 2026-05-14
T-APT-15 Tencent BlueNoroff 2018-03-07 2018-03-07
TA444 Proofpoint CryptoCore 2021-10-27 2026-04-01
TAG-71 RecordedFuture BlueNoroff 2023-06-06 2024-01-10
TEMP.Hermit Fireeye BlueNoroff 2017-09-13 2025-05-14
TraderTraitor USCISA BlueNoroff 2022-04-18 2026-05-18
UNC1069 Mandiant CryptoCore 2023-04-18 2026-05-19
UNC1758 Mandiant TEMP.Hermit 2023-04-18 2023-04-18
UNC2970 Mandiant TEMP.Hermit 2023-03-09 2026-02-13
UNC4034 Mandiant TEMP.Hermit 2022-09-14 2022-11-03
UNC4899 Mandiant TraderTraitor 2023-07-24 2026-03-09
UNC577 Mandiant TEMP.Hermit 2023-03-09 2023-03-09
UNC785 Mandiant TEMP.Hermit 2023-03-28 2023-03-28
UNC786 Mandiant TEMP.Hermit 2023-03-28 2023-03-28

Reports

2026-04-27
ArcticWolf
BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector
#BlueNoroff #ClickFix #Fileless
2026-04-09
Kaspersky
The axios attack is an extension of the GhostCall campaign by BlueNoroff
#Axios #BlueNoroff #NPM #GhostCall #SysPhon
2026-04-03
DCSO
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff
#Axios #BlueNoroff #NPM
2026-04-01
Hunt.io
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444
#Axios #NPM #TA444 #BlueNoroff
2026-03-31
N3mes1s
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution
#Axios #BlueNoroff #NPM
2026-03-18
Bitrefill
March 1st incident report
#Bitrefill #BlueNoroff
2026-03-11
Ahnlab
2026년 2월 APT 그룹 동향 보고서
#BlueNoroff #Lazarus #Medusa
2026-01-29
Daylight
North Korea’s “Prospect Call” Trap: Lazarus Turns Teams Meetings into macOS Credential Theft
#BlueNoroff #GhostCall
2026-01-20
PicusSecurity
BlueNoroff Group: The Financial Cybercrime Arm of Lazarus
#BlueNoroff
2025-12-13
Tay
DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets
#BlueNoroff
2025-11-29
Whoisxmlapi
Going DNS Deep Diving Into GhostCall and GhostHire
#BlueNoroff #GhostCall #GhostHire
2025-10-28
Kaspersky
BlueNoroff's latest campaigns: GhostCall and GhostHire
#BlueNoroff #macOS #GhostCall #GhostHire #SysPhon
2025-10-15
Huntress
Bluenoroff's Clues
#BlueNoroff #Slides
2025-07-22
Whoisxmlapi
Beneath the Belly of the Latest BlueNoroff Attack
#BlueNoroff
2025-07-02
CriminalIP
North Korean Hacker Group Bluenoroff Attempts Hacking Attack via Zoom
#BlueNoroff
2025-06-23
Darkatlas
Bluenoroff (APT38) Live Infrastructure Hunting
#BlueNoroff
2025-06-20
FieldEffect
Zoom & doom: BlueNoroff call opens the door
#BlueNoroff
2025-06-20
Validin
Zooming through BlueNoroff Indicators with Validin
#BlueNoroff #macOS
2025-06-18
Huntress
Inside the BlueNoroff Web3 macOS Intrusion Analysis
#BlueNoroff #macOS
2025-04-11
CyberBlade
MoonPeaking Into Kimsuky Operations
#BlueNoroff #Kimsuky #Lazarus #MoonPeak
2025-01-20
lazarusholic
An exploratory analysis of the DPRK cyber threat landscape using publicly available reports
#Andariel #BlueNoroff #Kimsuky #Konni #Lazarus #ScarCruft
2025-01-14
Hunt.io
'JustJoin' Landing Page Linked to Suspected DPRK Activity Resurfaces
#BlueNoroff #JustJoin
2024-12-06
Proofpoint
A Better Way, YARA-X, Mach-O Feature Extraction, and Malware Similarity
#Youtube #AppleJeus #BlueNoroff #TraderTraitor #YARA
2024-11-10
TLP_R3D
Analysis of BlueNoroff Hidden Risk Indicators!
#BlueNoroff #HiddenRisk #Youtube
2024-11-08
Rewterz
North Korean Threat Actors Deploy Hidden Risk Malware on macOS to Target Crypto Firms – Active IOCs
#BlueNoroff #HiddenRisk
2024-11-07
SentinelOne
BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence
#BlueNoroff #HiddenRisk #macOS
2024-10-23
Kaspersky
Lazarus APT steals cryptocurrency and user data via a decoy MOBA game
#CVE-2024-4947 #DeFiTankLand #Lazarus #Manuscrypt #BlueNoroff
2024-08-16
Kandji
TodoSwift Disguises Malware Download Behind Bitcoin PDF
#BlueNoroff #macOS #KANDYKORN
2024-03-07
UN
S/2024/215 Final report of the Panel of Experts
#CyberLink #JumpCloud #Andariel #Kimsuky #BlueNoroff #ScarCruft #Alphapo #CoinsPaid #Merlin #Steadefi #Fantom #Terraport #UnoRe #HECO #HTX #OrbitBridge #Poloniex #NexusMutual #Indodax #CoinEx #bZx #Qubit #DeFiance #Bondly #Fetchai #MGNR #EasyFi #FinNexus #Eterbase #KuCoin #Cryptopia #AlgoCapital #CoinTiger #BiKi #CoinBene #Gateio #Coinrail #Bancor #Tradeio #CoinSecure #Cypherium #Taylor #Sanctions
2024-02-28
Hunt.io
Phishing by Appointment: Suspected North Korean Hackers Target Blockchain Community Via Telegram
#Phishing #BlueNoroff
2024-01-04
Objective-see
Analyzing DPRK's SpectralBlur
#SpectralBlur #BlueNoroff #macOS
2023-12-05
Kaspersky
New BlueNoroff loader for macOS
#RustBucket #BlueNoroff #macOS
2023-11-27
SentinelOne
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads
#RustBucket #BlueNoroff #macOS #KANDYKORN
2023-11-13
Sakai
북한 라자루스(Lazarus) 산하 BlueNorOff(블루노로프) 만든 맥OS 악성코드-ProcessRequest(2023.11.7)
#BlueNoroff #macOS
2023-11-07
Jamf
BlueNoroff strikes again with new macOS malware
#RustBucket #BlueNoroff #macOS #ObjCShellz
2023-10-13
Jamf
A Journey into Reversing RustBucket on macOS
#RustBucket #BlueNoroff #macOS
2023-09-12
UN
S/2023/656 Midterm report of the Panel of Experts
#Kimsuky #BlueNoroff #Sanctions
2023-09-01
JPMOFA
北朝鮮の核その他の大量破壊兵器及び弾道ミサイル関連計画その他の北朝鮮に関連する国際連合安全保障理事会決議により禁止された活動等に関与する者に対する資産凍結等の措置の対象者の追加について
#Sanctions #News #BlueNoroff #Andariel
2023-07-27
Kaspersky
APT trends report Q2 2023
#BlueNoroff #Trend
2023-07-05
SentinelOne
BlueNoroff | How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection
#RustBucket #BlueNoroff #macOS
2023-06-29
Elastic
The DPRK strikes using a new variant of RUSTBUCKET
#RustBucket #BlueNoroff #macOS #REF9135
2023-05-22
SEKOIA
Bluenoroff’s RustBucket campaign
#RustBucket #BlueNoroff #macOS
2023-05-12
PolySwarm
BlueNoroff's RustBucket MacOS Malware
#RustBucket #BlueNoroff #macOS
2023-04-27
Sakai
북한 라자루스(Lazarus) 산하 BlueNorOff(블루노로프) 만든 맥OS 악성코드-Internal PDF Viewer(2023.4.23)
#BlueNoroff #macOS #RustBucket
2023-04-21
Jamf
BlueNoroff APT group targets macOS with ‘RustBucket’ Malware
#RustBucket #BlueNoroff #macOS
2023-04-10
Sakai
대북 관계자들을 노리는 BlueNorOff(블루노로프)-질문지.doc(2023.04.06)
#BlueNoroff
2022-12-27
Kaspersky
BlueNoroff introduces new methods bypassing MoTW
#BlueNoroff
2022-09-07
UN
S/2022/668 Midterm report of the Panel of Experts
#Sanctions #BlueNoroff #DreamJob #Kimsuky #NukeSped #Stonefly #VHD
2022-04-19
Rekt
Big Phish
#Cryptocurrency #BlueNoroff #DeFiance #NexusMutual
2022-03-01
UN
S/2022/132 Final report of the Panel of Experts
#Sanctions #Vyveva #Andariel #BlueNoroff #Kimsuky #Konni
2022-01-13
Kaspersky
The BlueNoroff cryptocurrency hunt is still on
#Cryptocurrency #BlueNoroff #SnatchCrypto
2021-11-05
bZx
Preliminary Post Mortem
#Cryptocurrency #BlueNoroff #bZx
2019-12-04
Kaspersky
APT review: what the world’s threat actors got up to in 2019
#Trend #Andariel #BlueNoroff #Lazarus
2019-09-13
USTreasury
North Korea Designations; Global Magnitsky Designation
#RedDot #Office91 #Appleworm #Sanctions #APT-C-26 #APT38 #Andariel #BlueNoroff #Group77
2019-09-13
USTreasury
Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups
#News #BlueNoroff #Andariel
2017-12-31
Kaspersky
Never Let Your Infrastructure Go Malicious: Digging Into C&C Infrastructure of Lazarus
#BlueNoroff #Slides #Manuscrypt
2017-04-03
Kaspersky
Lazarus Under The Hood
#BlueNoroff #BangSwift
2017-04-03
Kaspersky
Lazarus Under The Hood
#Whitepaper #BlueNoroff #BangSwift