APT Profile: Who is Lazarus Group?
2021-12-02 • SOCRadar •
SOCRadar profiles Lazarus Group as a DPRK Reconnaissance General Bureau-linked threat actor also tracked under names such as Hidden Cobra, Zinc, Guardians of Peace, and Stardust Chollima. The source emphasizes that Lazarus blends political, espionage, disruptive, and financially motivated operations, targeting South Korea, the United States, finance, defense, public administration, research, cryptocurrency, journalists, human-rights groups, and North Korean defector communities. It describes common access methods including spearphishing, supply-chain and watering-hole attacks, zero-day and known-vulnerability exploitation, and custom malware for persistence, data theft, and destructive activity. The profile also notes boundary ambiguity with subgroups and overlapping clusters such as Bluenoroff, Andariel, TEMP.Hermit, and Kimsuky, and cites tools including AppleSeed, HardRain, BadCall, Fallchill, Joanap, Brambul, and WannaCry.