TA404, a DPRK threat actor-lazarusholic

TA404

2022-07-14, Proofpoint
Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media

Name	Named by	AKA	First seen	Last seen
APT-C-26	Qihoo360	Lazarus	2018-08-15	2026-06-03
APT-Q-1	Qianxin	Lazarus	2023-03-14	2025-08-28
Appleworm	Symantec	Lazarus	2017-04-01	2021-02-18
BlackArtemis	PWC	Lazarus	2020-03-03	2023-04-12
Bureau121	-	Lazarus	-	2020-11-23
CitrineSleet	Microsoft	Lazarus	2023-10-06	2025-03-27
DEV-0139	Microsoft	Lazarus	2022-12-06	2022-12-06
G0032	MITRE	Lazarus	2017-05-31	2017-05-31
GodsApostles	SelfGiven	Lazarus	2014-11-24	-
GodsDisciples	SelfGiven	Lazarus	2014-11-24	-
Greedyman	KRCERT	Lazarus	2020-02-29	-
Group77	CiscoTalos	Lazarus	2016-02-24	2019-09-13
GuardiansofPeace	SelfGiven	Lazarus	2014-11-24	2014-12-05
Hastati	SecureWorks	Lazarus	-	2013-03-21
HiddenCobra	USCISA	Lazarus	2017-06-13	2021-03-25
ITG03	IBM	Lazarus	-	-
LabyrinthChollima	CrowdStrike	Lazarus	2018-02-26	2026-02-06
Lazarus	Novetta	-	2016-02-24	2026-05-22
MoonstoneSleet	Microsoft	Lazarus	2024-05-28	2025-11-24
NickelAcademy	SecureWorks	Lazarus	-	2024-10-08
Office91	-	Lazarus	-	2019-09-13
REF7001	Elastic	Lazarus	2023-11-01	2024-10-03
REF9134	Elastic	Lazarus	2023-06-21	2023-06-21
RGB-D3	IssuemakersLab	Lazarus	2020-05-20	2020-09-08
SectorA01	NSHC	Lazarus	2019-01-23	2025-11-25
SelectivePisces	PaloaltoNetworks	Lazarus	2022-09-26	2024-09-09
TA404	Proofpoint	Lazarus	2022-07-14	2022-07-14
UAT-10027	CiscoTalos	Lazarus	2026-02-26	2026-02-26
Unit121	-	Lazarus	-	2020-11-23
VoidImugi	TrendMicro	Lazarus	2024-06-10	2025-03-18
WASSONITE	Dragos	Lazarus	2020-05-30	2023-02-14
WHOisTeam	Mcafee	Lazarus	2013-03-20	2014-12-23
Zinc	Microsoft	Lazarus	2017-12-19	2022-11-22

2022-07-14
Proofpoint
Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media
#TA404