Lazarus Group
View MITRE Group Page ↗Key Facts
- Attributed Country: Democratic People's Republic of Korea.
- ATT&CK Group Reference: G0032 (Lazarus Group).
- Linked to 5 primary court prosecution record(s) with $6.5 billion documented loss.
- Identified 1 individually charged operative(s) and 2 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1485 Data Destruction | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1021.002 SMB / Windows Admin Shares | 1 incidents |
| T1566.002 Spearphishing Link | 1 incidents |
| T1027 Obfuscated Files or Information | 1 incidents |
| T1001.002 Steganography | 1 incidents |
| T1068 Exploitation for Privilege Escalation | 1 incidents |
| T1003 OS Credential Dumping | 1 incidents |
Prosecution Cases Attributed to Lazarus Group
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
Sony Pictures Entertainment Destructive Wiper Attack
North Korean state-sponsored operators infiltrated Sony Pictures Entertainment, deploying destructive Shamoon/Destover wipers that permanently erased thousands of servers and workstations, exfiltrating terabytes of unreleased films, employee SSNs, and executive emails.
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
3CX DesktopApp Cascading Supply Chain Attack (Lazarus Group)
North Korean state-sponsored threat group Lazarus compromised VoIP communications software provider 3CX, injecting malware into digitally signed Windows and macOS builds of 3CXDesktopApp downloaded by over 600,000 corporate customers, in the first documented case of one software supply chain compromise directly enabling a second downstream supply chain breach.
U.S. v. Roman Storm & Alexey Pertsev (Tornado Cash $1B Heist)
Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.
Indicted Operatives & Dispositions (1)
Lazarus Group computer programmer charged with WannaCry, Sony Pictures attack, and Bangladesh Bank heist.
Treasury OFAC Sanctions Actions
Decentralized cryptocurrency mixer used by the Lazarus Group to launder over $455 million in stolen crypto.
Official Treasury Press Release ↗North Korean state-sponsored hacking organization responsible for WannaCry, Sony Pictures hack, and crypto heists.
Official Treasury Press Release ↗Documented TTP Signature for Lazarus Group
Test Controls in Stack Audit →Adversaries irreversibly overwrite storage media and files to destroy data rather than extort ransoms.
Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
Adversaries leverage Server Message Block (SMB) and administrative shares (C$, ADMIN$) for lateral spread.
Adversaries send spearphishing emails containing malicious hyperlinks to lure users into downloading payloads or entering credentials.
Adversaries encrypt or encode payload strings and executable code to conceal malicious contents.
Adversaries hide command payloads or stolen data within image or media files.