UNC786 | lazarus.day

UNC786

2023-03-28 • Mandiant • APT43: North Korean Group Uses Cybercrime to Fund…

61

Related Actors
822

Related Reports

Related Actors

Lazarus

Novetta

First seen: Feb 2016

Last seen: Oct 2026

Appleworm

Symantec

Lazarus

First seen: Apr 2017

Last seen: Feb 2021

APT-C-26

Qihoo360

Lazarus

First seen: Aug 2016

Last seen: Jul 2026

Citrine Sleet

Microsoft

Lazarus

First seen: Dec 2022

Last seen: Sep 2026

UNC1720

Mandiant

Apple Jeus

First seen: Oct 2023

Last seen: Aug 2025

REF7001

Elastic

Lazarus

First seen: Nov 2023

Last seen: Oct 2024

Black Artemis

PWC

Lazarus

First seen: Mar 2020

Last seen: Apr 2023

Bureau121

Lazarus

First seen: Dec 2015

Last seen: Jan 2023

COVELLITE

Dragos

Black Artemis

First seen: May 2018

Last seen: May 2018

UNC785

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

Moonstone Sleet

Microsoft

Lazarus

First seen: May 2024

Last seen: Sep 2026

DEV-0139

Microsoft

Citrine Sleet

First seen: Dec 2022

Last seen: Dec 2022

Storm-1789

Microsoft

Moonstone Sleet

First seen: May 2024

Last seen: May 2024

G0032

MITRE

Lazarus

First seen: May 2017

Last seen: May 2017

Gods Apostles

Self Given

Lazarus

Gods Disciples

Self Given

Lazarus

Guardiansof Peace

Self Given

Lazarus

First seen: Dec 2014

Last seen: Apr 2021

Group77

Cisco Talos

Lazarus

First seen: Feb 2016

Last seen: Sep 2019

Hastati

Secure Works

Lazarus

First seen: Mar 2013

Last seen: Dec 2014

Hidden Cobra

USCISA

Lazarus

First seen: Jun 2017

Last seen: Mar 2021

New Romanic Cyber Army Team

Mcafee

Guardiansof Peace

First seen: Jul 2013

Last seen: Dec 2014

Greedyman

KRCERT

Lazarus

Labyrinth Chollima

Crowd Strike

Lazarus

First seen: Feb 2018

Last seen: Jun 2026

Stressed Pungsan

Datadog

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

Nickel Academy

Secure Works

Lazarus

First seen: Dec 2017

Last seen: Oct 2024

Office91

Lazarus

First seen: Sep 2019

Last seen: Sep 2019

TA404

Proofpoint

Lazarus

First seen: Jul 2022

Last seen: Jul 2022

Gleaming Pisces

Paloalto Networks

Citrine Sleet

First seen: Sep 2024

Last seen: May 2026

TEMP.Hermit

Fireeye

Lazarus

First seen: Mar 2022

Last seen: Sep 2026

Red Dot

Ahnlab

Labyrinth Chollima

First seen: Jul 2017

Last seen: Sep 2019

Sector A01

NSHC

Lazarus

First seen: Jan 2019

Last seen: Nov 2025

Void Imugi

Trend Micro

Lazarus

First seen: Jun 2024

Last seen: Mar 2025

Selective Pisces

Paloalto Networks

Lazarus

First seen: Sep 2022

Last seen: Sep 2024

UNC4034

Mandiant

TEMP.Hermit

First seen: Sep 2022

Last seen: Nov 2022

Unit121

Lazarus

First seen: Nov 2020

Last seen: Nov 2020

WHOis Team

Mcafee

Lazarus

First seen: Mar 2013

Last seen: Dec 2014

Zinc

Microsoft

Lazarus

First seen: Dec 2017

Last seen: Nov 2022

G1036

MITRE

Moonstone Sleet

First seen: Aug 2024

Last seen: Aug 2024

RGB-D3

Issuemakers Lab

Lazarus

First seen: May 2020

Last seen: Sep 2020

UNC577

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

BABYLONGROUP

Chollima Group

Moonstone Sleet

First seen: Aug 2025

Last seen: Sep 2025

APT-Q-1

Qianxin

Lazarus

First seen: Mar 2023

Last seen: Aug 2025

UNC2970

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Feb 2026

Apple Jeus

Kaspersky

Gleaming Pisces

First seen: Aug 2018

Last seen: May 2026

G1049

MITRE

Apple Jeus

First seen: Aug 2025

Last seen: Aug 2025

CTG-2460

Secure Works

Nickel Academy

First seen: Sep 2020

Last seen: Sep 2020

Golden Chollima

Crowd Strike

Citrine Sleet

First seen: Jan 2026

Last seen: May 2026

Pompilus

Symantec

Diamond Sleet

First seen: Apr 2022

Last seen: Apr 2022

UAT-10027

Cisco Talos

Lazarus

First seen: Feb 2026

Last seen: Feb 2026

UTA0040

Volexity

UNC4736

First seen: Mar 2023

Last seen: Mar 2023

UNC4736

Mandiant

Apple Jeus

First seen: Apr 2023

Last seen: May 2026

Diamond Sleet

Microsoft

Zinc

First seen: Apr 2023

Last seen: Feb 2024

Storm-0139

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

Storm-1222

Microsoft

Citrine Sleet

First seen: Apr 2023

Last seen: Apr 2023

WASSONITE

Dragos

Lazarus

First seen: May 2020

Last seen: Feb 2023

ITG03

IBM

Lazarus

First seen: Nov 2021

Last seen: Nov 2021

Larva-26005

Ahnlab

Lazarus

First seen: Aug 2026

Last seen: Aug 2026

UNC1758

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Apr 2023

Hermit Neptune

Google

TEMP.Hermit

First seen: Jul 2026

Last seen: Jul 2026

ATK3

Thales Group

Hidden Cobra

First seen: Oct 2019

Last seen: May 2022

REF9134

Elastic

Lazarus

First seen: Jun 2023

Last seen: Jun 2023

Related Reports in This Cluster

Top Authors

View UNC786 reports only

2026-10-28

ESET

ESET APT Activity Report Q2 2026–Q3 2026

#Lazarus #Scarcruft #DeceptiveDevelopment #Trend

2026-10-23

Cyfirma

Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

#Lazarus #T1190 #T1505.003 #PHP2Shell

2026-10-21

Kaspersky

«Операция FlashHole»: Lazarus взламывает защиту и обходит контроль

#FlashHole #Lazarus #TechHub #Cubridge #TouchHub #ClientHub #LPEClient #CrossWebEX #TOUCHSHIFT

2026-10-21

Kaspersky

Operation FlashHole: Lazarus breaks security, defies control

#Lazarus #CrossWebEX #LPEClient #TOUCHSHIFT #FlashHole #Cubridge #TechHub #TouchHub #ClientHub

2026-10-05

Zach XBT

How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group

#Lazarus #TraderTraitor #MoneyLaundering #Bitget #Bybit

2026-09-18

Ahnlab

August 2026 Threat Trend Report on APT Groups

#FamousChollima #PolinRider #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #Trend

2026-09-18

Ahnlab

2026년 8월 APT 그룹 동향 보고서

#FamousChollima #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #PolinRider #Trend

2026-09-07

Kudelski Security

Beyond Lazarus: Organization of DPRK Cyber Capabilities

#Lazarus #TEMP.Hermit #CitrineSleet #CryptoCore #JadeSleet #MoonstoneSleet #FamousChollima #ITWorker #Kimsuky #Andariel #APT38

2026-09-04

Rapid7

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

#Wateringhole #T1190 #T1059.004 #T1106 #T1543 #T1548 #T1036.005 #T1070.002 #T1070.006 #T1562.006 #T1027 #T1497.001 #T1480 #T1556.003 #T1082 #T1057 #T1185 #T1119 #T1071.001 #T1132.001 #T1102 #T1572 #T1568 #T1041 #T1560 #APT37 #HAProxy #curlRAT #Ted #Lazarus

2026-08-31

Coin Desk

North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform

#Lazarus #News #MoneyLaundering

2026-08-16

Decryption Digest

Lazarus Group CVE-2026-68820: Windows Zero-Day Rootkit

#Lazarus #CVE-2026-68820 #DreamJob #FudModule #MISTPEN #ForestTiger

2026-08-11

Checkpoint

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

#DreamJob #Lazarus #MISTPEN #FudModule #CVE-2026-68820 #ForestTiger #Troy

2026-08-07

Bybit

Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets in Landmark Crypto Asset Recovery Effort

#Bybit #Lazarus

2026-08-06

Ahnlab

Xctdoor와 과거 CRAT 공격 사례의 연관성 분석 (Larva-26005)

#Xctdoor #Phishing #LNK #CRAT #Larva-26005 #CVE-2017-8291 #Hansom

2026-08-06

Ahnlab

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

#Xctdoor #Phishing #LNK #CVE-2017-8291 #CRAT #Larva-26005 #Hansom

1
2
3
»
55

View UNC786 reports only