Also known as: Hidden Cobra, ZINC, Diamond Sleet, Labyrinth Chollima, APT38, Bluenoroff, Andariel, Guardians of Peace, Whois Team, TraderTraitor, Pompilus, Onyx Sleet, Stonefly, Selective Pisces, Alluring Pisces, Gleaming Pisces, Slow Pisces, Sparkling Pisces, Jumpy Pisces, Sapphire Sleet, Jade Sleet, Citrine Sleet, Moonstone Sleet, UNC2970, UNC4034, UNC4736, UNC4899, Famous Chollima, DeceptiveDevelopment, DEV#POPPER, Gwisin Gang, Tenacious Pungsan, UNC5342, Void Dokkaebi, CageyChameleon, CryptoCore, Genie Spider, BeagleBoyz, Black Artemis
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
Phishing
Send deceptive messages to trick victims into executing malicious content.
T1566.003
T1195.002
T1059.006
T1059.007
T1204.002
T1565.001
T1071.001
T1553.002
T1195.001
T1071.004
T1583.003
T1608.005
T1213.003
T1134.004
T1574.002
T1588.002
T1587.001
T1203
T1588.001
T1583.001
T1057
T1070.004
T1112
T1012
T1016
T1049
T1033
T1562.001
T1518.001
T1135
T1053.005
T1039
T1056.001
T1132.001
T1546.003
T1574.001
T1583.006
T1569.002
T1543.003
T1059.005
T1090.003
T1567.002
T1218.011
T1218.005
T1053.002
T1036.005
T1027.010
T1027.002
T1564.001
T1102
T1020
Obfuscated Files or Information
Encrypt, encode, or obfuscate payloads and data to evade detection.
Masquerading
Disguise malicious artifacts by manipulating names or locations to appear legitimate.
Process Injection
Inject code into running processes to evade defenses and elevate privileges.
Deobfuscate/Decode Files or Information
Decode or deobfuscate data and files that were previously hidden or encrypted.
System Information Discovery
Collect OS version, architecture, hostname, and other system details.
File and Directory Discovery
Enumerate files and directories to find sensitive data or binaries.
Remote System Discovery
Discover remote systems on the network for lateral movement targets.
Account Discovery
Enumerate local, domain, or cloud accounts on a system or environment.
Trojanized cryptocurrency trading applications distributed as legitimate software. Targets Windows and macOS to steal cryptocurrency wallet credentials and keys.
Primary RAT using dual-proxy communication with RC4 encryption. Provides full remote access including file management, process manipulation, and system information gathering.
Sophisticated RAT with proxy-aware C2 communication. Used in defense contractor targeting campaigns with capabilities for screen capture, file transfer, and process manipulation.
Advanced backdoor used in defense industry espionage campaigns. Capable of pivoting between IT and restricted OT networks within compromised organizations.
Modular spyware used for keylogging, browser history theft, and collecting running processes. Evolved from DarkSeoul tools used in attacks against South Korea.
Highly customizable backdoor family used across multiple Lazarus campaigns. Supports extensive plugins for reconnaissance, exfiltration, and lateral movement.
Cross-platform malware framework (Windows, Linux, macOS) with modular plugin architecture. Supports file manipulation, proxying, and loading additional modules from C2.
Used extensively for post-exploitation in financial sector attacks. Beacons deployed via spear-phishing or trojanized apps for lateral movement and data exfiltration.
Deployed for credential harvesting from Windows systems. Used to obtain NTLM hashes and Kerberos tickets for lateral movement within financial institution networks.
Used for fileless malware execution, downloading secondary payloads, and living-off-the-land reconnaissance in compromised enterprise environments.
Self-propagating ransomware worm that exploited EternalBlue (MS17-010). Infected 300,000+ computers across 150 countries in 2017, causing billions in damages.
Custom malware deployed on banking switch application servers to intercept and approve fraudulent ATM withdrawal requests. Used in ATM jackpotting campaigns across Asia and Africa.
Custom tunneling tool that creates encrypted channels between compromised networks and C2 infrastructure, allowing data exfiltration through proxied connections.
Supply chain attacks via malicious packages on npm and PyPI registries targeting cryptocurrency developers. Packages contain hidden backdoors activated on install.
Elaborate fake recruiter personas on LinkedIn to target cryptocurrency and defense sector employees. Delivers trojanized coding challenges or job-related documents.
Trojanized versions of legitimate PyPI packages targeting Python developers. Used as part of supply chain attacks against cryptocurrency companies.
Remote access tool used by Andariel subgroup for data exfiltration
Trojanized cryptocurrency wallet application targeting blockchain users
Malware specifically designed to compromise cryptocurrency trading platforms
Remote access backdoor with extensive data collection capabilities
Backdoor with command execution and data exfiltration functionality
Modular backdoor with extensive reconnaissance and persistence capabilities
Remote access trojan deployed in targeted attacks against energy and defense sectors
Backdoor malware used for lateral movement and data exfiltration
Remote access tool used in financial sector intrusions
Backdoor malware with modular capabilities for espionage operations
Legitimate VoIP application compromised in supply chain attack to distribute malware
Proxy tool and backdoor that establishes encrypted communications channels
Legitimate VoIP software compromised in major supply chain attack affecting 600,000+ organizations
Initial stage loader used to deploy additional malware payloads in targeted attacks
Multi-stage RAT targeting macOS systems, deployed against blockchain engineers via trojanized Discord applications
Supply chain compromise of 3CX VoIP desktop application distributing malware
Golang-based dropper used by Andariel subgroup in ransomware operations
| Type | Value |
|---|---|
| domain | celasllc[.]com |
| domain | unioncrypto[.]vip |
| ip | 185[.]29[.]8[.]18 |
| ip | 45[.]33[.]2[.]79 |
| hash | 5d9e5c7d05c3a2e2e0e7c2de42a7c4e7 |
| domain | codepool[.]cloud |
| domain | aurevian[.]cloud |
| domain | amazonfiso[.]com |
| domain | human-check[.]com |
| domain | zoom-tech[.]us |
| domain | zoom[.]webus02[.]us |
| ip | 23[.]27[.]140[.]49 |
| ip | 23[.]27[.]140[.]135 |
| hash | 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 |
| hash | 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 |
| domain | coingecko[.]store |
| domain | blockchain[.]zendesk[.]com |
| hash | 5c7c9b6f8c0e6f1e5f9c9e5d7e3a6c1e9f2b4d6a8c0e2f4b6d8a0c2e4f6a8c0e |
| domain | testapp[.]6sync[.]com |
| domain | coinkrx[.]com |
| hash | 5d3c6b3c4f6b3d3c4f6b3d3c4f6b3d3c |
| domain | zacharryblogs[.]com |
| domain | org-check-aws[.]com |
| hash | b5d33cea3c48e21408ee6fa7b11f39f5e3ec0e7e |
| domain | akamaicontainer[.]com |
| domain | coingomble[.]com |
| domain | dreamcryptohouse[.]com |
| hash | 3e101c0e76c8c0f4c6f3f4e6e9f0d8a9f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5 |
| Domain / Host | Status |
|---|---|
pypistorage[.]com | offline |
keondigital[.]com | active |
arcashop[.]org | whois_changed |
jdkgradle[.]com | offline |
latamics[.]org | offline |
lmaxtrd[.]com | offline |
paxosfuture[.]com | offline |
ftxstock[.]com | offline |
nansenpro[.]org | offline |
azureglobalaccelerator[.]com | active |
azuredeploypackages[.]net | active |
defitankwar[.]com | offline |
defitankzone[.]com | offline |
23[.]227[.]202[.]244 | offline |
codepool[.]cloud | active |
aurevian[.]cloud | whois_changed |
amazonfiso[.]com | whois_changed |
human-check[.]com | offline |
zoom-tech[.]us | offline |
zoom[.]webus02[.]us | offline |
dataupload[.]store | unknown |
filedrive[.]online | unknown |
system[.]updatecheck[.]store | unknown |
lianxinxiao[.]com | unknown |
blocknovas[.]com | unknown |
www[.]scoringmnmathleague[.]org | unknown |
backlinkbase[.]com | unknown |
coolproyect[.]es | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - Lazarus Group
https://attack.mitre.org/groups/G0032/
CISA - North Korean Malicious Cyber Activity
https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/north-korea
FBI - TraderTraitor: North Korean State-Sponsored APT Targets Blockchain
https://www.ic3.gov/Media/News/2022/220418.pdf
Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks
https://thehackernews.com/2026/02/lazarus-group-uses-medusa-ransomware-in.html
Lazarus Group Bitrefill Cyberattack
https://cyble.com/blog/lazarus-group-bitrefill-cyberattack/
FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist
https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
https://thehackernews.com/2025/09/lazarus-group-expands-malware-arsenal.html
North Korean Lazarus group targets the drone sector in Europe
https://www.globenewswire.com/news-release/2025/10/23/3171642/0/en/North-Korean-Lazarus-group-targets-the-drone-sector-in-Europe-likely-for-espionage-ESET-Research-discovers.html
Lazarus targets nuclear-related organization with new malware
https://securelist.com/lazarus-new-malware/115059/
BlueNoroff reemerges with new campaigns for crypto theft and espionage
https://www.csoonline.com/article/4081001/bluenoroff-reemerges-with-new-campaigns-for-crypto-theft-and-espionage.html
Zoom & doom: BlueNoroff call opens the door
https://fieldeffect.com/blog/zoom-doom-bluenoroff-call-opens-the-door
Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist
https://thehackernews.com/2025/02/bybit-confirms-record-breaking-146.html
CISA Alert (AA20-239A) - FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a
FBI Flash: Lazarus Group Targeting Cryptocurrency
https://www.ic3.gov/Media/News/2020/200916.pdf
Kaspersky: The BlueNoroff cryptocurrency hunt is still on
https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/
Mandiant: APT38: Un-usual Suspects
https://www.mandiant.com/resources/apt38-un-usual-suspects
CISA: #StopRansomware: Andariel
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
Microsoft: ZINC attacks cryptocurrency users
https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/
Kaspersky: Lazarus Cryptocurrency Supply Chain Attack
https://securelist.com/operation-applejeus/87553/
FBI: Blockchain Technology Targeting by North Korean Cyber Actors
https://www.ic3.gov/Media/News/2023/230828.pdf
ESET: Lazarus KandyKorn macOS malware
https://www.welivesecurity.com/2023/11/09/kandykorn-lazarus-group-attacking-blockchain-engineers/
CISA - Lazarus Group Cryptocurrency Theft Tradecraft
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
Microsoft - Tracking Persistent Threat Actor Groups: Lazarus/ZINC
https://www.microsoft.com/en-us/security/blog/threat-intelligence/threat-actors/zinc/
Kaspersky - Andariel evolves into ransomware operations
https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/107045/
Mandiant: APT38: Un-usual Suspects
https://www.mandiant.com/resources/blog/apt38-un-usual-suspects
Kaspersky: Lazarus Under The Hood
https://securelist.com/lazarus-under-the-hood/77908/
Symantec: Lazarus Targets Chemical Sector
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical
Microsoft: DIAMOND SLEET supply chain compromise distributes malicious packages
https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Kaspersky: BlueNoroff APT group targets financial organizations
https://securelist.com/bluenoroff-apt-group-financial-attacks/106886/
Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems
https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html
Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains
https://thehackernews.com/2025/10/researchers-expose-ghostcall-and.html
Kaspersky discovers Lazarus APT targets nuclear organizations with new CookiePlus malware
https://www.kaspersky.com/about/press-releases/kaspersky-discovers-lazarus-apt-targets-nuclear-organizations-with-new-cookieplus-malware
Lazarus Group's infrastructure reuse leads to discovery of new malware
https://blog.talosintelligence.com/lazarus-collectionrat/
North Korea's $1.5 Billion Bybit Heist: Inside the DPRK Crypto War Machine in 2026
https://cryptoimpacthub.com/north-korea-bybit-dprk-crypto-theft-2026/
BlueNoroff Group: The Financial Cybercrime Arm of Lazarus
https://www.picussecurity.com/resource/blog/bluenoroff-group-the-financial-cybercrime-arm-of-lazarus
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies
https://www.silentpush.com/blog/contagious-interview-front-companies/
Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks
https://securityscorecard.com/blog/lazarus-group-targets-developers-through-npm-packages-and-supply-chain-attacks/
Microsoft: ZINC attacks using OpenSource software supply chain
https://www.microsoft.com/en-us/security/blog/2021/10/28/zinc-attacks-using-opensource-software-supply-chain/
Mandiant: APT38: Details on New North Korean Regime-Backed Threat Group
https://www.mandiant.com/resources/blog/apt38-details-on-new-north-korean-regime-backed-threat-group
KANDYKORN: Lazarus Targeting Blockchain Engineers with Malicious Python Package
https://www.elastic.co/security-labs/elastic-response-to-the-the-kandykorn-malware-attack
Operation Dream Job: Widespread North Korean Espionage Campaign
https://www.clearskysec.com/operation-dream-job/
Lazarus Group Exploits Log4j Vulnerability in VMware Horizon
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a
Microsoft - ZINC weaponizing open-source software
https://www.microsoft.com/security/blog/2021/11/18/zinc-targeting-security-researchers-with-trojanized-tools/
Mandiant - APT38: Un-usual Suspects
https://www.mandiant.com/resources/blog/apt38-unusual-suspects
DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
KANDYKORN: North Korean Malware Targets macOS Cryptocurrency Exchange
https://www.elastic.co/security-labs/elastic-security-uncovers-KANDYKORN
3CX Supply Chain Attack: Lazarus Group Deployment
https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise
Lazarus Group Exploiting Zero-Day Vulnerabilities in Various Products
https://www.cisa.gov/news-events/alerts/2023/05/16/lazarus-group-exploiting-zero-day-vulnerabilities-various-products
North Korean Threat Actor Targets Blockchain Engineers with Fake Job Opportunities
https://www.sentinelone.com/labs/dprk-strikes-using-a-new-variant-of-rustbucket/