TA404

2022-07-14 • Proofpoint • Above the Fold and in Your Inbox: Tracing State-A…

59

Related Actors
659

Related Reports

Related Actors

Lazarus

Novetta

First seen: Feb 2016

Last seen: Jun 2026

Appleworm

Symantec

Lazarus

First seen: Apr 2017

Last seen: Feb 2021

APT-C-26

Qihoo360

Lazarus

First seen: Aug 2016

Last seen: Jun 2026

Citrine Sleet

Microsoft

Lazarus

First seen: Dec 2022

Last seen: May 2026

UNC1720

Mandiant

Apple Jeus

First seen: Oct 2023

Last seen: Aug 2025

REF7001

Elastic

Lazarus

First seen: Nov 2023

Last seen: Oct 2024

Black Artemis

PWC

Lazarus

First seen: Mar 2020

Last seen: Apr 2023

Bureau121

Lazarus

First seen: Nov 2020

Last seen: Nov 2020

COVELLITE

Dragos

Black Artemis

First seen: May 2018

Last seen: May 2018

UNC785

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

UNC786

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

Moonstone Sleet

Microsoft

Lazarus

First seen: May 2024

Last seen: Nov 2025

DEV-0139

Microsoft

Citrine Sleet

First seen: Dec 2022

Last seen: Dec 2022

Storm-1789

Microsoft

Moonstone Sleet

First seen: May 2024

Last seen: May 2024

G0032

MITRE

Lazarus

First seen: May 2017

Last seen: May 2017

Gods Apostles

Self Given

Lazarus

Gods Disciples

Self Given

Lazarus

Guardiansof Peace

Self Given

Lazarus

First seen: Dec 2014

Last seen: Dec 2014

Group77

Cisco Talos

Lazarus

First seen: Feb 2016

Last seen: Sep 2019

Hastati

Secure Works

Lazarus

First seen: Mar 2013

Last seen: Mar 2013

Hidden Cobra

USCISA

Lazarus

First seen: Jun 2017

Last seen: Mar 2021

New Romanic Cyber Army Team

Mcafee

Guardiansof Peace

First seen: Jul 2013

Last seen: Dec 2014

Greedyman

KRCERT

Lazarus

Labyrinth Chollima

Crowd Strike

Lazarus

First seen: Feb 2018

Last seen: Jun 2026

Stressed Pungsan

Datadog

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

Nickel Academy

Secure Works

Lazarus

First seen: Dec 2017

Last seen: Oct 2024

Office91

Lazarus

First seen: Sep 2019

Last seen: Sep 2019

Gleaming Pisces

Paloalto Networks

Citrine Sleet

First seen: Sep 2024

Last seen: May 2026

TEMP.Hermit

Fireeye

Lazarus

First seen: Mar 2023

Last seen: May 2025

Red Dot

Ahnlab

Labyrinth Chollima

First seen: Jul 2017

Last seen: Sep 2019

Sector A01

NSHC

Lazarus

First seen: Jan 2019

Last seen: Nov 2025

Void Imugi

Trend Micro

Lazarus

First seen: Jun 2024

Last seen: Mar 2025

Selective Pisces

Paloalto Networks

Lazarus

First seen: Sep 2022

Last seen: Sep 2024

UNC4034

Mandiant

TEMP.Hermit

First seen: Sep 2022

Last seen: Nov 2022

Unit121

Lazarus

First seen: Nov 2020

Last seen: Nov 2020

WHOis Team

Mcafee

Lazarus

First seen: Mar 2013

Last seen: Dec 2014

Zinc

Microsoft

Lazarus

First seen: Dec 2017

Last seen: Nov 2022

G1036

MITRE

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

RGB-D3

Issuemakers Lab

Lazarus

First seen: May 2020

Last seen: Sep 2020

UNC577

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

BABYLONGROUP

Chollima Group

Moonstone Sleet

First seen: Aug 2025

Last seen: Sep 2025

APT-Q-1

Qianxin

Lazarus

First seen: Mar 2023

Last seen: Aug 2025

UNC2970

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Feb 2026

Apple Jeus

Kaspersky

Gleaming Pisces

First seen: Aug 2018

Last seen: May 2026

G1049

MITRE

Apple Jeus

First seen: Aug 2025

Last seen: Aug 2025

CTG-2460

Secure Works

Nickel Academy

First seen: Sep 2020

Last seen: Sep 2020

Golden Chollima

Crowd Strike

Citrine Sleet

First seen: Jan 2026

Last seen: May 2026

Pompilus

Symantec

Diamond Sleet

First seen: Apr 2022

Last seen: Apr 2022

UAT-10027

Cisco Talos

Lazarus

First seen: Feb 2026

Last seen: Feb 2026

UTA0040

Volexity

UNC4736

First seen: Mar 2023

Last seen: Mar 2023

UNC4736

Mandiant

Apple Jeus

First seen: Apr 2023

Last seen: May 2026

Diamond Sleet

Microsoft

Zinc

First seen: Apr 2023

Last seen: Feb 2024

Storm-0139

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

Storm-1222

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

WASSONITE

Dragos

Lazarus

First seen: May 2020

Last seen: Feb 2023

ITG03

IBM

Lazarus

First seen: Nov 2021

Last seen: Nov 2021

UNC1758

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Apr 2023

ATK3

Thales Group

Hidden Cobra

First seen: Oct 2019

Last seen: May 2022

REF9134

Elastic

Lazarus

First seen: Jun 2023

Last seen: Jun 2023

Related Reports in This Cluster

Top Authors

View TA404 reports only

2026-06-25

Cyfirma

APT QUARTERLY REPORT : APR TO JUN 2026

#Lazarus #Kimsuky #Andariel #SapphireSleet #Trend

2026-06-23

Cognyte

Lazarus Targets the Financial Sector with Memory-Only Malware Toolset

#Lazarus #Fileless #RemotePE #YARA #T1055 #T1027 #T1027.007 #T1105

2026-06-22

Melted In Hex

Dead Drops on the Blockchain: Reversing a DPRK npm Loader (PolinRider / A6-Shadow-15)

#Lazarus #PolinRider #BeaverTail #InvisibleFerret #NPM #EtherHiding

2026-06-19

Blackfog

Lazarus Group Cyber Attacks: What Businesses Need To Know

#Lazarus #Trend

2026-06-18

Sygnia

Bybit Heist Case Study: When Billions Vanish

#Bybit #Lazarus #SafeWallet #Cryptocurrency #SupplyChain

2026-06-18

Red Asgard

The Day It Became Access: How Fake Interviews Turn Developer Trust Into Attack Surface

#Lazarus #Podcast

2026-06-18

Open Source Malware

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

#Mastra #NPM #SupplyChain #Lazarus #T1195.001 #T1555 #T1105 #T1059.007

2026-06-16

Ahnlab

May 2026 Threat Trend Report on APT Groups

#Trend #Lazarus #FamousChollima #Kimsuky #TA-RedAnt

2026-06-16

Ahnlab

2026년 5월 APT 그룹 동향 보고서

#Lazarus #FamousChollima #Kimsuky #TA-RedAnt #Trend

2026-06-12

i QBlack

DEVIL MARLBORO offers for sale an alleged intelligence package linked to Kimsuky and Lazarus Group

#Kimsuky #Lazarus #Suspicious

2026-06-11

Red Asgard

The Google Mirror: Browser Trust as the Attack Surface

#Lazarus #Podcast

2026-06-09

Crowd Strike

CrowdStrike 2026 Report: China Fuels Attacks on Tech

#FamousChollima #LabyrinthChollima #StardustChollima #Trend

2026-06-08

Open Source Malware

Active Malware Campaigns in January-May 2026

#Lazarus #ContagiousInterview #NPM #PyPI #Trend #PolinRider #TasksJacker

2026-06-06

Red Asgard

OtterCookie: The Malware That Watched the Developer

#Lazarus #OtterCookie #Podcast

2026-06-03

Sonatype

Lazarus Group's Latest: Brandjacking Campaign on npm

#Lazarus #NPM #SupplyChain #T1195 #T1059.007 #T1027 #T1105

View TA404 reports only