This Korean translation of a VB2021 paper explains how Lazarus activity fragmented after 2018 into multiple clusters that share roots in Manuscrypt but differ in delivery, tooling, and mission focus. It describes AppleJeus attacks against cryptocurrency targets, ThreatNeedle infections delivered through watering holes, spearphishing documents, and trojanized software, and DeathNote/Dream Job operations that shifted from cryptocurrency exchanges toward defense-industry lures. The excerpt also covers Bookcode supply-chain and watering-hole activity, CookieTime malware using encoded cookie values and steganographic command delivery, and the MATA/Dacls framework across Windows, Linux, and macOS. The report is useful for DPRK tracking because it emphasizes cluster boundaries, overlapping payloads such as Manuscrypt/Fallchill and COPPERHEDGE, and the need to avoid treating every Lazarus-linked intrusion as a single homogeneous campaign.