Lazarus Group

On attribution: "Lazarus Group" is a label applied by governments and security firms to overlapping North Korean state hacking units. Attributions below are those of the cited authorities (FBI, U.S. Treasury, DOJ, UN) and analytics firms (Chainalysis, Elliptic, Mandiant); cyber-attribution is rarely 100% certain. See the linked case entries for incident-specific findings.

Overview

Lazarus Group is the most common name for a set of state-sponsored hacking units operated by North Korea's military-intelligence agency, the Reconnaissance General Bureau (RGB). When the U.S. Treasury sanctioned it in September 2019, it listed numerous aliases used across the security industry, including Hidden Cobra, Guardians of Peace, APT-C-26, Group 77, Office 91, ZINC, and TEMP.Hermit. The same action sanctioned two RGB sub-groups, Bluenoroff (a.k.a. APT38) and Andariel. ^[1]

Structure and sub-units

Researchers track several overlapping clusters under the Lazarus/RGB umbrella:

• Bluenoroff / APT38 — focused on financial theft (banks, exchanges). ^[1][2]
• Andariel — espionage plus revenue generation. ^[1]
• TraderTraitor (Jade Sleet / UNC4899) — recent exchange mega-thefts (see its own entry).
• Contagious Interview / UNC4736 (AppleJeus, Citrine Sleet) — fake-recruiter malware (see its own entry).

A February 2021 U.S. indictment alleged these RGB units operated as "a single conspiracy." ^[2]

Early operations (pre-crypto)

Lazarus is linked to a string of landmark intrusions: the 2014 Sony Pictures Entertainment hack; the February 2016 Bangladesh Bank heist, in which attackers used compromised SWIFT credentials to issue 35 fraudulent transfer requests totaling ~$951 million (most were blocked, but ~$81 million was taken and laundered through Philippine casinos); and the 2017 WannaCry ransomware outbreak. The Bangladesh heist marked a turning point — a nation-state stealing for profit. ^[2][6]

Pivot to cryptocurrency

From around 2017, Lazarus increasingly targeted cryptocurrency. Campaigns such as "AppleJeus" distributed trojanized trading apps, and the group went after exchanges, cross-chain bridges, DeFi protocols, wallet software, and individual holders. U.S. and UN officials assess the proceeds fund North Korea's nuclear-weapons and ballistic-missile programs.