lazarusholic

Everyday is lazarus.dayβ

PaloaltoNetworks

@Unit42_Intel, https://paloaltonetworks.com

Actors

Name Named by AKA First seen Last seen
AlluringPisces PaloaltoNetworks BlueNoroff 2024-09-09 2025-02-26
ContagiousInterview PaloaltoNetworks FamousChollima 2024-10-09 2026-06-16
CrookedPisces PaloaltoNetworks Konni 2021-09-30 2021-09-30
GleamingPisces PaloaltoNetworks CitrineSleet 2024-09-09 2024-09-18
JumpyPisces PaloaltoNetworks Andariel 2024-06-28 2025-04-23
MoldyPisces PaloaltoNetworks TEMP.Reaper 2021-09-30 2021-09-30
Pisces PaloaltoNetworks - - -
SelectivePisces PaloaltoNetworks Lazarus 2022-09-26 2024-09-09
SlowPisces PaloaltoNetworks JadeSleet 2024-06-28 2025-04-14
SparklingPisces PaloaltoNetworks Kimsuky 2024-09-09 2024-09-26

Reports

2026-04-01
PaloaltoNetworks
Widespread Impact of the Axios Supply Chain Attack
#Axios #NPM
2026-02-04
PaloaltoNetworks
CONTAGIOUS INTERVIEW CAMPAIGN ACTIVITY
#ContagiousInterview
2025-06-17
PaloaltoNetworks
Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation
#KimjongRAT #LNK
2025-04-23
PaloaltoNetworks
Extortion and Ransomware Trends January-March 2025
#JumpyPisces #Ransomware #Trend
2025-04-21
PaloaltoNetworks
False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation
#Deepfake #ITWorker
2025-04-14
PaloaltoNetworks
Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
#RNLoader #RNStealer #SlowPisces
2025-02-26
PaloaltoNetworks
RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
#ContagiousInterview #Koi #RustDoor #macOS #AlluringPisces
2024-11-14
PaloaltoNetworks
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack
#BeaverTail #CL-STA-0237 #ITWorker #Wagemole
2024-11-13
PaloaltoNetworks
Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
#ITWorker #Wagemole #PiKVM #TinyPilot
2024-10-30
PaloaltoNetworks
Jumpy Pisces Engages in Play Ransomware
#DTrack #JumpyPisces #Play
2024-10-09
PaloaltoNetworks
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
#BeaverTail #ContagiousInterview #InvisibleFerret
2024-09-26
PaloaltoNetworks
Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy
#FPSpy #KLogEXE #SparklingPisces
2024-09-18
PaloaltoNetworks
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors
#GleamingPisces #PondRAT #PyPI
2024-09-09
PaloaltoNetworks
Threat Assessment: North Korean Threat Groups
#AlluringPisces #CollectionRAT #Comebacker #Fullhouse #GleamingPisces #JumpyPisces #KANDYKORN #ObjCShellz #OdicLoader #POOLRAT #PondRAT #RustBucket #SelectivePisces #SlowPisces #SmoothOperator #SparklingPisces
2024-06-28
PaloaltoNetworks
Threat Actor Groups Tracked by Palo Alto Networks Unit 42
#SlowPisces #JumpyPisces
2023-11-21
PaloaltoNetworks
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
#InvisibleFerret #ContagiousInterview #Wagemole #BeaverTail #NPM
2023-03-30
PaloaltoNetworks
Threat Brief: 3CXDesktopApp Supply Chain Attack
#SupplyChain #3CXDesktopApp #SmoothOperator
2022-09-26
PaloaltoNetworks
Hunting for Unsigned DLLs to Find APTs
#SelectivePisces
2021-09-30
PaloaltoNetworks
Moldy Pisces
#MoldyPisces
2021-09-30
PaloaltoNetworks
Crooked Pisces
#CrookedPisces
2020-01-23
PaloaltoNetworks
The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks
#Konni #FracturedStatue
2019-04-26
PaloaltoNetworks
BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat
#BabyShark #KimjongRAT
2019-02-22
PaloaltoNetworks
New BabyShark Malware Targets U.S. National Security Think Tanks
#BabyShark
2018-11-29
PaloaltoNetworks
The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asi
#FracturedBlock
2018-10-01
PaloaltoNetworks
NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT
#TEMP.Reaper #DOGCALL #NOKKI
2018-09-28
PaloaltoNetworks
New KONNI Malware attacking Eurasia and Southeast Asia
#Konni #NOKKI
2018-07-31
PaloaltoNetworks
Bisonal Malware Used in Attacks Against Russia and South Korea
#Bisonal
2018-04-05
PaloaltoNetworks
Reaper Group’s Updated Mobile Arsenal
#TEMP.Reaper #KevDroid
2017-11-20
PaloaltoNetworks
Operation Blockbuster Goes Mobile
#Mobile #Blockbuster
2017-10-05
PaloaltoNetworks
FreeMilk: A Highly Targeted Spear Phishing Campaign
#FreeMilk #CVE-2017-0199
2017-08-14
PaloaltoNetworks
The Blockbuster Saga Continues
#Blockbuster
2017-04-07
PaloaltoNetworks
The Blockbuster Sequel
#Blockbuster #Lazarus
2015-11-23
PaloaltoNetworks
Inside TDrop2: Technical Analysis of new Dark Seoul Malware
#TDrop2 #DarkSeoul
2015-11-18
PaloaltoNetworks
TDrop2 Attacks Suggest Dark Seoul Attackers Return
#TDrop2 #DarkSeoul