threat actor

Lazarus Group

activeentity:threat_actor

[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: lazarus-group
kind: threat actor
status: active
aliases: Diamond Sleet · Guardians of Peace · HIDDEN COBRA · Labyrinth Chollima · NICKEL ACADEMY · ZINC
jurisdictions: —
claims naming it: 0 · 0 attributions · 22 relations · 0 events

Identifiers

attack G0032via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatLazarus GroupusesProxysvc
fetch —sha256 dc1639caa5501d72
rel_544btcintel:relations:544@v1 sha256:b68ccf366b079bae
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesBADCALL
fetch —sha256 dc1639caa5501d72
rel_545btcintel:relations:545@v1 sha256:620e0a059aff8e37
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesFALLCHILL
fetch —sha256 dc1639caa5501d72
rel_546btcintel:relations:546@v1 sha256:f908855f0297a616
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesWannaCry
fetch —sha256 dc1639caa5501d72
rel_547btcintel:relations:547@v1 sha256:b2ddc83b5d0a2f6e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesMagicRAT
fetch —sha256 dc1639caa5501d72
rel_548btcintel:relations:548@v1 sha256:329f932833b82afe
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesHOPLIGHT
fetch —sha256 dc1639caa5501d72
rel_549btcintel:relations:549@v1 sha256:3951474f1dab23e5
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesTYPEFRAME
fetch —sha256 dc1639caa5501d72
rel_550btcintel:relations:550@v1 sha256:01dd3fe6a75599fb
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesDtrack
fetch —sha256 dc1639caa5501d72
rel_551btcintel:relations:551@v1 sha256:a877c4c7a7dc30bc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesHotCroissant
fetch —sha256 dc1639caa5501d72
rel_552btcintel:relations:552@v1 sha256:176d5b024a36ac1c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesHARDRAIN
fetch —sha256 dc1639caa5501d72
rel_553btcintel:relations:553@v1 sha256:9826c501911e0ad1
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesDacls
fetch —sha256 dc1639caa5501d72
rel_554btcintel:relations:554@v1 sha256:93f4ca7080dce98c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesKEYMARBLE
fetch —sha256 dc1639caa5501d72
rel_555btcintel:relations:555@v1 sha256:00034bc8b561d13c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesTAINTEDSCRIBE
fetch —sha256 dc1639caa5501d72
rel_556btcintel:relations:556@v1 sha256:16cfd5dbe1c49066
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesAuditCred
fetch —sha256 dc1639caa5501d72
rel_557btcintel:relations:557@v1 sha256:5bba6de74569c823
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesECCENTRICBANDWAGON
fetch —sha256 dc1639caa5501d72
rel_558btcintel:relations:558@v1 sha256:08fc1840cbcd8996
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesAppleJeus
fetch —sha256 dc1639caa5501d72
rel_559btcintel:relations:559@v1 sha256:a610d1d9dc8c66a4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesBLINDINGCAN
fetch —sha256 dc1639caa5501d72
rel_560btcintel:relations:560@v1 sha256:ddac67b414ff88a0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesThreatNeedle
fetch —sha256 dc1639caa5501d72
rel_561btcintel:relations:561@v1 sha256:29c172bc09e25c20
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesVolgmer
fetch —sha256 dc1639caa5501d72
rel_562btcintel:relations:562@v1 sha256:bf62baf8c359503d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesCryptoistic
fetch —sha256 dc1639caa5501d72
rel_563btcintel:relations:563@v1 sha256:ce80322e91ca0f4e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesRATANKBA
fetch —sha256 dc1639caa5501d72
rel_564btcintel:relations:564@v1 sha256:3e766856eb605a78
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLazarus GroupusesBankshot
fetch —sha256 dc1639caa5501d72
rel_565btcintel:relations:565@v1 sha256:a71f6bf61b8faa45
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.