Lazarus Group: North Korea's Hacking Umbrella Explained

Lazarus Group is the name the FBI, CISA and the US Treasury use, together with many security vendors, for a long-running body of North Korean state-sponsored hacking. Treasury linked Lazarus and two related groups to North Korea's Reconnaissance General Bureau when it sanctioned them on 13 September 2019. The label is best read as an umbrella: MITRE notes that public reporting often uses it for multiple North Korean cyber operators, and that those operators share personnel, infrastructure, malware and tradecraft. Its work has two main purposes, raising revenue for the regime and collecting intelligence, with destructive attacks earlier in its record. The latest development: on 1 November 2026 the FBI attributed the theft of more than $6 billion from Binance to TraderTraitor, the North Korean activity it also tied to the Bybit theft in 2025.

Who this is for: CISOs, security architects, threat-intel and detection leads, and anyone in crypto, defense, aerospace, nuclear, engineering, healthcare or software supply chains.

Based on US government documents, vendor reports and press coverage listed under Sources. PlayCISO is not affiliated with any of them. This post describes behaviour only at the level needed to detect and defend; it contains no operational detail for attackers. Crypto-theft tradecraft is covered in the TraderTraitor profile.

What "Lazarus" actually covers

The name began as a vendor label for a cluster of activity and became the government's shorthand. The US government's own umbrella for North Korean malicious cyber activity is HIDDEN COBRA, per the CISA advisories AA21-048A and MITRE's group entry. MITRE describes Lazarus Group as attributed to the RGB and says North Korean units "frequently share personnel, infrastructure, malware, and tradecraft", which makes attributing a specific operation with high confidence difficult (MITRE ATT&CK G0032).

Three practical consequences. A report that says "Lazarus" may mean any of several teams. Two vendors can describe the same intrusion under different names. And a government naming a thing "TraderTraitor" or "AppleJeus" is naming malware or activity, not a new organisation. Use the table to translate.

Names and aliases: who calls what

Sources: MITRE G0032, MITRE G0082, CISA AA22-108A, CISA AA24-207A, Mandiant APT45, Microsoft, Wiz, Axios on Mandiant APT43, Treasury. Look any name up in APT Rosetta.

What it wants: two missions

• Revenue. Treasury says Bluenoroff was formed to generate illicit revenue under sanctions and carry out heists on foreign financial institutions. The FBI said in January 2023 that the Harmony Horizon theft proceeds supported North Korea's missile and weapons programmes (as reported by The Record). The Multilateral Sanctions Monitoring Team, made up of 11 countries, describes theft and fraudulent IT work as ways North Korea evades UN sanctions.
• Intelligence. CISA says Andariel pursues sensitive military information and intellectual property, primarily in defense, aerospace, nuclear and engineering, with lesser focus on medical and energy. Mandiant says APT45 has also targeted healthcare, pharmaceuticals and, in 2019, nuclear research facilities. ESET reported a 2025 Dream Job wave against European defense and drone makers aimed at "exfiltration of proprietary information and manufacturing know-how".
• Destruction and disruption (mostly earlier). Sony Pictures (2014) and WannaCry 2.0 (2017) are listed by Treasury against Lazarus. CISA notes Andariel has shifted from destructive attacks towards espionage and ransomware.

Mandiant also says financially motivated activity alongside intelligence collection is now a defining feature of North Korean cyber operations. The fake-job approach appears in both the crypto record and the defense record, so the same social-engineering pattern can reach very different victims.

Dated record of notable operations

Attribution in each row is the named source's, not ours. Dollar amounts are as that source states them.

The crypto thefts at the end of this table are analysed in the TraderTraitor profile and, for the money trail, in our Binance hack post.

How much? Why the totals disagree

• Treasury (2019): Bluenoroff attempted to steal more than $1.1 billion from financial institutions by 2018.
• DOJ (2021 indictment, as reported): attempts to steal or extort more than $1.3 billion across 2009 to 2020. That measures attempts, not losses.
• MSMT (Oct 2025, as reported): at least $1.19 billion in cryptocurrency in 2024 and at least $1.65 billion from January to September 2025, mostly the Bybit theft. Other coverage of the same report gives about $2.84 billion over 21 months.
• Chainalysis (Dec 2025, as reported): about $2.02 billion in 2025, and $6.75 billion cumulatively since it began tracking in 2022. Its July 2025 half-year figure of $2.17 billion was higher than its year-end figure; coverage does not explain why.
• Elliptic (Nov 2026, via The Hacker News): DPRK-linked actors are believed to have stolen over $6.5 billion in recent years; it says the Binance theft "almost doubles" the total.

Treat these as independent estimates by different methods, not one running tally. Most are attributed to North Korean actors in general, not to a Lazarus sub-cluster by name. Binance's loss figure is itself reported variously: the FBI says "more than $6 billion"; TRM Labs about $6.36 billion; The Hacker News $6.43 billion.

Tactics defenders will recognise

This is a summary at ATT&CK-technique level, mapped by PlayCISO from the sources above. It is for detection and planning.

The FBI/CISA advisory notes that after access the actors spread across the network, take private keys and make fraudulent transactions, sometimes within a week of first access. We do not reproduce tool names, infrastructure or procedures beyond what a defender needs to write a detection.

How defenders should think about it

1. Plan against objectives, not the label. Ask which of its missions your assets serve. Holding crypto or payment rails means revenue targeting. Defense, aerospace, nuclear, engineering, healthcare and pharma means espionage. Selling software to either means you are a stepping stone.
2. Treat hiring as an attack surface. The same fake-job approach appears in the crypto record (AA22-108A, DMM) and in defense espionage (ESET). Recruiters, "coding tests" and shared files that reach a work device are the doorway.
3. Assume the vendor chain is in scope. 3CX and CyberLink show software you trust being turned into delivery. Know what you install and who signs it.
4. Expect speed and patience together. The advisory says post-compromise theft can complete within a week; the DMM case shows weeks between first contact and loss. Detection must cover both.
5. Keep the umbrella and the cluster apart in reports. Write "assessed to be North Korean state-sponsored; tracked by X as Y" and keep vendor names attached. It stops a board paper treating three different clusters as one.
6. Do not over-attribute. Attribution can lag. Run response on behaviours and evidence, and let governments and your CTI partner decide the name.

What a crypto exchange, custodian or platform should do

The owner view in one sentence: if you run a cryptocurrency business, platform or exchange moving more than $1 million a day, you need a threat intelligence function that uses automation, including AI, to learn everything there is to know about Lazarus and TraderTraitor, tracks them continuously through partnerships with specialised CTI companies, and feeds that into controls. Otherwise you risk being the next incident the industry reads about. Concretely:

• Signing and approval workflows. No single person or system can move funds alone. Require independent, out-of-band verification of the destination and amount a human is approving, on a device that is not the one that produced the request. Test that what the signer sees is what will be executed.
• Wallet infrastructure. Keep hot wallets small and rate-limited, use multisig or MPC with signers in separate trust domains, hardware-backed keys, withdrawal allow-lists and velocity limits that trip a hold, not just an alert.
• Developer and admin workstations. Separate devices for work that touches production, signing or release. Application allow-listing, managed browsers and no personal repositories or "assessment" projects on a work machine. The 2022 advisory says system administration and DevOps staff are frequent targets, and the DMM case began with a recruiter approach to an employee of its wallet-management vendor.
• Software supply chain. Pin and verify dependencies, installers and CI actions; watch for unexpected changes to signed vendor software; restrict who can publish to your build pipeline.
• Fake-job and social-engineering defence. Brief engineers, DevOps and administrators on recruiter approaches. Give them a safe route to report one. Treat any unsolicited file from a "recruiter" as hostile.
• Vendors and third parties. Custody and wallet-infrastructure providers can be the weak link, as the DMM case showed through its wallet manager. Contract for security reporting, access reviews and incident notification.
• Monitoring and CTI partnerships. Subscribe to a specialised CTI provider and an on-chain analytics provider; ingest the FBI's published addresses automatically; screen deposits against them; keep a named owner for DPRK threat intelligence.
• Incident readiness. Pre-agree who can pause withdrawals, who talks to stablecoin issuers and other exchanges, and how you reach the FBI and IC3. Rehearse it with the IR Playbook Lab and write the plan with the incident response plan builder.
• Law-enforcement liaison. Know your FBI field office contact before you need it. CISA and the FBI ask victims to report; the FBI's Bybit and Binance notices ask exchanges and analytics firms to block listed addresses.

Deeper crypto detail, including how the money moved in recent cases, is in the TraderTraitor profile.

What security leaders should do this week

1. List your assets by North Korean mission: money movement, defense or engineering IP, or software that reaches either.
2. Ask your CTI provider which names they use for these clusters and map them with APT Rosetta so reports from different vendors line up.
3. Send a short warning to engineering, DevOps, admin and recruiting teams: unsolicited recruiter contact plus a file or coding test is the pattern.
4. Check that no developer or admin runs unvetted "interview" projects on a machine that can reach production, signing or release.
5. Confirm that no single person or system can approve and execute a high-value payment or transfer. Test the out-of-band check.
6. Subscribe to the FBI's and CISA's DPRK notices and load published wallet addresses into screening if you handle crypto.
7. Review software and installer sources for anything you trust implicitly; check signing and update paths.
8. Name the owner for DPRK threat intelligence and confirm your FBI and IC3 contacts.
9. Run a 30-minute tabletop: a fake recruiter leads to a compromised engineer laptop. Who finds out, and when?

Frequently asked questions

What is the Lazarus Group?

Lazarus Group is the name governments and security vendors use for a long-running set of North Korean state-sponsored hacking operations. The FBI, CISA and Treasury describe it as a North Korean state-sponsored advanced persistent threat; Treasury says it is linked to the Reconnaissance General Bureau (RGB), North Korea's main intelligence bureau. MITRE notes that public reporting often uses "Lazarus Group" as an umbrella term for multiple North Korean cyber operators, so the label covers more than one team.

Is Lazarus Group the same as North Korea's hackers in general?

Not exactly. Lazarus is the most widely used umbrella label, but other North Korean clusters carry their own names. Mandiant says APT43, widely known as Kimsuky, is distinct and separate from other North Korean operators, and describes APT45 (Andariel) as having its own malware lineage while noting its activity is frequently reported as linked to Lazarus. Which team an incident belongs to depends on which vendor you ask.

Who is behind the Lazarus Group?

The US government attributes it to the North Korean state. Treasury linked Lazarus, Bluenoroff and Andariel to the Reconnaissance General Bureau when it sanctioned them on 13 September 2019, and a 2018 Justice Department complaint alleged that a programmer who worked for a North Korean front company, Chosun Expo, was a member of the team. These are government allegations and designations; North Korea has denied involvement in incidents such as Sony and WannaCry.

Is Lazarus the same as TraderTraitor?

They overlap, and sources describe the relationship differently. The 2022 FBI, CISA and Treasury advisory says the cryptocurrency-theft actors it describes are commonly tracked as Lazarus Group, APT38, BlueNoroff and Stardust Chollima, and that the US government calls the malicious applications "TraderTraitor". The FBI has since used TraderTraitor as the name of the actor behind the Bybit and Binance thefts. Wiz treats it as a Lazarus subgroup. See our TraderTraitor profile for the crypto-specific detail.

What is the difference between Lazarus, APT38, BlueNoroff and Andariel?

Treasury's 2019 sanctions release called Bluenoroff and Andariel sub-groups of Lazarus: Bluenoroff to raise revenue through heists on financial institutions, Andariel for cybercrime and for intelligence collection on South Korean targets. MITRE lists APT38, BlueNoroff and Stardust Chollima as associated names and warns that North Korean group definitions overlap significantly. Mandiant's APT45 report treats Andariel as a distinct cluster with its own malware genealogy.

How much has Lazarus stolen?

No single figure is authoritative, because sources measure different things over different periods. The Multilateral Sanctions Monitoring Team (MSMT), reported by news outlets, counted at least $1.19 billion in 2024 and at least $1.65 billion from January to September 2025. Chainalysis put 2025 at about $2.02 billion. Elliptic, as cited by The Hacker News, says DPRK-linked actors are believed to have stolen over $6.5 billion in recent years, before counting the Binance theft. Many of these are attributed to North Korean actors generally, not to Lazarus by name.

What was the biggest Lazarus hack?

By value, the most recent: on 1 November 2026 the FBI attributed the theft of more than $6 billion in virtual assets from Binance, on or about 29 October 2026, to TraderTraitor, saying North Korea was responsible. Before that, the FBI attributed about $1.5 billion taken from Bybit on or about 21 February 2025 to TraderTraitor. Binance has said it has covered most of the affected amount.

Was WannaCry a Lazarus attack?

The US government attributed WannaCry to North Korea in December 2017, and Treasury's 2019 sanctions release lists WannaCry 2.0 among the activities of the Lazarus Group. The Justice Department's 2018 complaint also alleged Lazarus involvement. North Korea rejected the accusation, and security experts have noted that technical forensics alone gives limited certainty about origin.

Does Lazarus do espionage or theft?

Both, and historically destruction as well. Treasury lists the 2014 Sony Pictures attack and WannaCry 2.0 against Lazarus and bank and crypto theft against Bluenoroff. CISA says Andariel conducts espionage on defense, aerospace, nuclear and engineering targets, and ESET reported a 2025 Operation DreamJob wave against European defense and drone firms, aimed at proprietary information and manufacturing know-how.

How do I defend against Lazarus?

Defend against the behaviours, not the label. The recurring ones are fake-recruiter approaches that lead to a trojanised file or app, poisoned software and vendor updates, stolen credentials, and, for crypto firms, manipulation of the signing and approval path. Use hardware-backed MFA, isolate developer and admin workstations, control what software can run, verify what you sign out of band, and keep a CTI partner who tracks DPRK clusters. The checklist below turns this into steps.

Is it Lazarus or Kimsuky?

They are different labels. Kimsuky is the common name for what Mandiant tracks as APT43, a North Korean cluster Mandiant assesses to be distinct and separate from other North Korean operators, with espionage as its primary mission. Lazarus is the broader umbrella usually associated with destructive attacks, financial theft and defense-sector espionage. Some reporting blends them, so check which vendor's name a report is using.

Keep learning

Look up which vendor name means which cluster in APT Rosetta, explore relationships in the APT knowledge graph, follow new reporting in the APT intel feed, and read the crypto-focused TraderTraitor profile.

Sources

Primary government and vendor documents first. "As reported" means we relied on coverage of the document because the primary page was not readable to us.

• CISA, FBI, Treasury: AA22-108A, TraderTraitor (18 Apr 2022)
• CISA, FBI, Treasury: AA21-048A, AppleJeus (17 Feb 2021)
• CISA and partners: AA24-207A, Andariel (25 Jul 2024)
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (26 Feb 2025)
• US Treasury: sanctions on Lazarus Group, Bluenoroff and Andariel (13 Sep 2019)
• US Treasury: Blender.io mixer sanctions (6 May 2022)
• US Department of Justice: complaint against Park Jin Hyok (Sep 2018), as reported
• CBS News on the Department of Justice indictment (17 Feb 2021), as reported
• US Department of Justice: coordinated actions against North Korean remote IT workers (30 Jun 2025): a separate DPRK revenue stream, not described as Lazarus in the sources we read
• MITRE ATT&CK: Lazarus Group (G0032) and APT38 (G0082)
• Mandiant (Google Cloud): APT45, North Korea's digital military machine (25 Jul 2024)
• Mandiant: 3CX software supply chain compromise (20 Apr 2023)
• Microsoft: Diamond Sleet supply chain compromise, CyberLink installer (22 Nov 2023)
• ESET: Lazarus targets the drone sector in Europe, Operation DreamJob (23 Oct 2025)
• Multilateral Sanctions Monitoring Team second report (22 Oct 2025) and WorldECR summary
• The Record on Chainalysis 2025 North Korea figures
• Axios: Mandiant on APT43 (28 Mar 2023)
• Wiz: TraderTraitor deep dive
• BleepingComputer: FBI links $6.3 billion Binance heist to North Korean hackers (1 Nov 2026)
• The Hacker News: FBI links TraderTraitor to the Binance heist (1 Nov 2026)
• AP via ABC News: FBI blames North Korea for stolen billions from Binance
• Nextgov: FBI involved in response to Binance hack (30 Oct 2026)
• The Record: FBI attributes Harmony theft to Lazarus (Jan 2023)
• Blockworks: FBI says North Korea behind Ronin hack (Apr 2022)
• Cointelegraph: FBI reveals DMM crypto hack was North Korea (Dec 2024)
• Al Jazeera: FBI says North Korea behind Sony hacking (19 Dec 2014)
• Threatpost: US government blames North Korea for WannaCry (Dec 2017)