Everyday is lazarus.dayβ


He is everywhere

2016-02-24, Novetta
Operation Blockbuster
"Lazarus Group is a threat group that has been attributed to the North Korean government. The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. In late 2017, Lazarus Group used KillDisk, a disk-wiping tool, in an attack against an online casino based in Central America."

"Lazarus, Hebrew Eleazar, (“God Has Helped”), either of two figures mentioned in the New Testament. The miraculous story of Lazarus being brought back to life by Jesus is known from the Gospel According to John (11:1–45). Lazarus is also the name given by the Gospel According to Luke (16:19–31) to the beggar in the parable of the rich man and Lazarus."

- Britannica,
"The Archbishop Lazarus was an ambassador from the Zakarum Church and an advisor to King Leoric."

- DiabloWiki,
"Lazarus Group (also known by other monikers such as Guardians of Peace or Whois Team) is a cybercrime group made up of an unknown number of individuals. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them over the last decade. Originally a criminal group, the group has now been designated as an advanced persistent threat due to intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity firms include HIDDEN COBRA (by the United States Intelligence Community) and Zinc (by Microsoft)."

- Wikipedia,
"Lazarus Group is commonly believed to be run by the North Korean government, motivated primarily by financial gain as a method of circumventing long-standing sanctions against the regime. They first came to substantial media notice in 2013 with a series of coordinated attacks against an assortment of South Korean broadcasters and financial institutions using DarkSeoul, a wiper program that overwrites sections of the victims’ master boot record."

"Lazarus是一个高度活跃、极具破坏性的由朝鲜国家资助的APT组织,主要目的是进行间谍活动、数据窃取、获取经济利益和进行网络破坏等。该组织长期对韩国、美国、中国、印度等国家进行渗透攻击,此外还对全球的金融机构进行攻击,堪称全球金融机构的最大威胁。据报道,Lazarus此前使用各种自定义远程访问工具,包括FoggyBrass和PhantomStar。此外,该组织主要采用鱼叉式网络钓鱼策略,但也被观察到使用社会工程学技术来攻击目标。该组织自2007年开始活跃,其攻击活动在2014年和2015年激增,先后对超过30个国家和地区发动过网络攻击,其中知名的行动有Operation GhostSecret,针对韩国的Troy Operation以及DarkSeoul Operation和2014年针对Sony公司的攻击等。2018年9月,美国对与Lazarus组织有关的3人提起了刑事指控。2022年4月下旬至9月中旬期间,该组织继续针对美国、英国、印度和俄罗斯等国家媒体、国防和航空航天以及IT服务等多个行业的组织中的员工开展了社会工程学活动。"

- RedQueen,
"The Lazarus Group is a nickname for the group of malware authors identified in Operation Blockbuster, a united effort between the company Novetta and a number of other entities. This hacker group has been linked to a number of attacks over the years, including the attack on Sony from 2014."

- IBM,
"Dashboard for Lazarus Group"

- ArkhamIntelligence,
"Lazarus Group Threat Actor Intelligence Profile"

- Cybergeist,

Also known as

Name Named by AKA First seen Last seen
APT-C-26 Qihoo360 Lazarus 2018-08-15 2024-01-30
APT-Q-1 Qianxin Lazarus 2023-03-14 2024-02-02
ATK3 ThalesGroup HiddenCobra 2019-10-07 2022-05-31
Appleworm Symantec Lazarus 2017-04-01 2021-02-18
BlackArtemis PWC Lazarus 2020-03-03 2023-04-12
Bureau121 - Lazarus - 2020-11-23
COVELLITE Dragos BlackArtemis 2018-05-31 2018-05-31
CTG-2460 SecureWorks NickelAcademy - -
CitrineSleet Microsoft Lazarus 2023-10-06 2023-10-26
DEV-0139 Microsoft Lazarus 2022-12-06 2022-12-06
DiamondSleet Microsoft Zinc 2023-04-19 2023-12-29
G0032 MITRE Lazarus 2017-05-31 2017-05-31
GodsApostles SelfGiven Lazarus 2014-11-24 -
GodsDisciples SelfGiven Lazarus 2014-11-24 -
Group77 CiscoTalos Lazarus 2016-02-24 2019-09-13
GuardiansofPeace SelfGiven Lazarus 2014-11-24 2014-12-05
Hastati SecureWorks Lazarus - 2013-03-21
HiddenCobra USCISA Lazarus 2017-06-13 2020-06-23
ITG03 IBM Lazarus - -
LabyrinthChollima CrowdStrike Lazarus 2018-02-26 2023-10-13
Lazarus Novetta - 2016-02-24 -
NewRomanicCyberArmyTeam Mcafee GuardiansofPeace 2013-07-08 2014-12-23
NickelAcademy SecureWorks Lazarus - 2017-12-15
Office91 - Lazarus - 2019-09-13
REF7001 Elastic Lazarus 2023-11-01 2023-11-01
REF9134 Elastic Lazarus 2023-06-21 2023-06-21
RGB-D3 IssuemakersLab Lazarus 2020-05-20 2020-09-08
RedDot Ahnlab LabyrinthChollima 2017-07-03 2019-09-13
SelectivePisces PaloaltoNetworks Lazarus 2022-09-26 2022-09-26
TA404 Proofpoint Lazarus 2022-07-14 2022-07-14
UNC4736 Mandiant CitrineSleet 2023-04-11 2023-04-20
Unit121 - Lazarus - 2020-11-23
WASSONITE Dragos Lazarus 2020-05-30 2023-02-14
WHOisTeam Mcafee Lazarus 2013-03-20 2014-12-23
Zinc Microsoft Lazarus 2017-12-19 2022-11-22