The earliest signs of the Lazarus group can be traced back to 2007, when North Korea was under the rule of Kim Jong Il, father of the current leader Kim Jong Un. It is believed that Lazarus was established as a cyber warfare unit under the Reconnaissance General Bureau (RGB), North Korea’s primary intelligence agency. During this period, the development of cyber capabilities was seen as essential to the regime’s asymmetric warfare strategy. Kim Jong Il was said to be an enthusiastic proponent of this, stating that “cyber-attacks are like atomic bombs” and that “war is won and lost by who has greater access to the adversary’s military technical information in peacetime.”[2] The Lazarus group’s earliest operations tended to focus on espionage and disruption, primarily targeting organizations in the United States and South Korea.
After the death of Kim Jong Il in 2011, Kim Jong Un sought to expand on his fathers’ vision and harness the state’s cyber capabilities to generate revenue for the sanction-hit regime. Starting in 2015, Lazarus began conducting financially motivated operations, first focusing on banks and later cryptocurrency exchanges. North Korea has a long history of using criminal activities, including counterfeiting, drug trafficking and insurance fraud, to support its struggling economy. With its growing cyber capabilities, shifting these efforts to cyberspace likely felt like a natural evolution.[3]
What makes Lazarus stand out from other APTs is the breadth and diversity of its operations; the group has targeted a wide range of sectors over the years, including but not limited to the aerospace, banking, pharmaceuticals, energy, healthcare, technology, education, and transportation sectors. The group’s targeting appears to shift in line with the regime’s ambitions, as well as external events such as the COVID-19 pandemic. The regime relies on espionage and information theft to bypass (often difficult and expensive) R&D processes that are required for the advancement and modernization of the state.
Additionally, Lazarus has repeatedly targeted governments and military organizations to obtain intelligence and undermine their adversaries. In 2016, the group breached South Korea’s Defense Ministry and reportedly obtained classified military documents outlining a joint US-South Korea combat strategy, including procedures to “decapitate” the North Korean leadership.[4] Such campaigns are used to strengthen North Korea’s strategic position and pre-empt threats from their regional neighbors.
Group structure
It should be noted that the Lazarus group is often used as an umbrella term referring to multiple North Korean cyber operators. Based on analysis of various toolsets and attack patterns, Lazarus can be divided into sub-groups with varying objectives. Two commonly cited sub-groups are BlueNorOff, which is believed to be the unit responsible for financially motivated attacks, and AndAriel, which focuses its operations on foreign businesses, government agencies, and financial services infrastructure. According to some estimates, BlueNorOff (also referred to as APT38) boasts approximately 1,700 members, while AndAriel has around 1,600 members.[5]
In addition to BlueNorOff and AndAriel, Mandiant designates an additional sub-group - TEMP.Hermit. This unit is believed to focus on strategic intelligence gathering and is known to have targeted organizations in the government, defense, telecommunications, and financial sectors. It is believed that these three units are subordinate to an agency named Lab 110, previously Bureau 121, which is known as North Korea’s primary hacking unit. The relationship between these groups is shown in the chart below.[6]
Figure 1. Assessed structure of North Korean APT groups (Source: Mandiant)
However, it’s worth noting that due to the inherently clandestine nature of cyber threats, verifying this structure is no easy task. To complicate matters further, there are overlaps in tools and techniques between North Korea’s Kimsuky and APT37. This poses challenges for attribution and obscures our view of how these cyber teams are organized.
Figure 2 - The Lazarus group’s preferred TTPs mapped to the MITRE ATT&CK framework
Lazarus exhibits a sophisticated operational approach, utilizing a diverse set of Tactics, Techniques, and Procedures (TTPs) throughout its campaigns. During the Initial Access phase, the group frequently relies on spear-phishing, a method that involves sending carefully crafted emails containing malicious attachments or links to individuals within the desired organization. These emails are designed to appear legitimate, leveraging social engineering tactics to deceive recipients into interacting with the malicious content, thereby facilitating initial access to the target network. Lazarus has done this using various file types, including malicious Word documents, ZIP archives, optical disc images (ISO), and virtual hard disks (VHD).[46] The group successfully breached Sony's systems in 2014 using this technique and expanded this approach to leverage social media sites such as LinkedIn during Operation Dream Job. Additionally, the group likes to use Drive-by Compromise (T1189) and watering hole attacks. These techniques were observed during the Bangladesh bank heist (2016), Operation BookCodes (2020), and Operation GoldGoblin (2023).[47]
After Lazarus obtains initial access, they use various techniques to move further into the target network while evading detection. To escalate privileges, the group has been observed using DLL hijacking on Windows hosts, as well as using Scheduled Task/Job (T1053) to execute remote XSL scripts and drop VBS payloads at specific intervals. To maintain persistence, the group favours techniques such as Boot or Logon Autostart Execution (T1547), allowing them to automatically configure system settings to execute a program during system boot or logon, as well as Scheduled Task/Job (T1053) to execute malicious binaries at regular intervals. To evade detection, the group often eradicates evidence of their activities (T1070), employs masquerading techniques (T1036), and abuses system binaries, such as PowerShell, for proxy execution (T1218). Besides these (relatively common) defense evasion tactics, the group has been observed using custom tools to remain under the radar. During a 2023 campaign targeting fintech companies, the group leveraged a tool capable of selectively wiping individual entries from log files if they contain a given IP address on Linux systems. This allows an attacker to efficiently remove traces of network activity in bulk.[48]
One notable aspect of the group’s modus operandi relates to the use of a multi-layered Command and Control (C2) infrastructure, comprised of servers with SSL encrypted channels established between them. The image below shows the composition of this infrastructure, based on Group IB’s analysis of the Bangladesh bank heist and subsequent attacks against Polish financial institutions.
Figure 3 - The Lazarus group’s multi-layer C2 infrastructure. Source: Group IB[49]
Here, the Layer 1 server serves as the primary C2 server, directly engaging with the targeted computer. Once again, the Lazarus group’s commitment to stealth shines through. By utilizing SSL encrypted channels as part of its C2 infrastructure, Lazarus can successfully conceal the traffic content from network defenders and monitoring systems. As a result, even if the traffic is intercepted, it appears as incomprehensible ciphertext, making it challenging to discern the malicious intent or payload.
During previous campaigns targeting the banking sector, Lazarus hackers safeguarded their anonymity by employing a legitimate VPN client known as SoftEther. In some cases, they also like to use corporate web servers strategically placed within the targeted organization, providing an additional layer of camouflage. When traffic between the compromised systems and the C2 servers stays within the organization's internal network, the chances of detection are reduced.[50]
This may sound like bad news for blue teamers, but a silver lining appears when looking at the Lazarus group's playbook (hint: they like to recycle). The group has continued to use much of the same infrastructure across its campaigns, despite these components being well-known to the security community. This presents an opportunity for defenders to create custom detection rules specific to the Lazarus group’s toolkit. It also presents avenues for the discovery of new IOCs, as demonstrated when Talos used this method to identify CollectionRAT malware last year.[51]
Data log sources refer to the various systems, devices, applications, and network components that generate logs containing information about their activities. These logs are crucial for monitoring and analysing security events, detecting anomalies, and responding to incidents. In order to achieve the highest possibility of detecting malicious activity associated with the Lazarus group, Hunt & Hackett's research suggests monitoring specific data log sources as the basis for developing detection logic. A starting point is to look at the preferred means of attack.
.png?width=2033&height=600&name=amCharts(10).png)
Figure 4 – The Lazarus group’s preferred techniques connected to the targeted data source
Analyzing how often Lazarus employs its preferred tactics, techniques, and procedures (TTPs) can provide a clearer understanding of the group’s capabilities and operational methods. According to the data collected by Hunt & Hackett, the group’s most frequently used tactic is Command Execution, which accounts for about 14% of known TTPs. This takes place after initial compromise, when the threat actor deploys a command-and-control infrastructure, establishes a communication channel and executes commands on the target system. As discussed in the previous section, Lazarus has been known to employ a multi-layered C2 infrastructure consisting of several servers connected by SSL encrypted channels, ensuring the group’s activities remain under the radar. Detection of these activities is possible by performing internal SSL offloading to inspect the content of internal traffic. To detect tools executed over the command and scripting interpreter, thorough logging and application of detection logic is required. It is also necessary to integrate threat intelligence to enhance detection and response capabilities.
The second most popular technique is Process Creation, which accounts for roughly 13% of the Lazarus group's TTPs. This enables the threat actor to create system-level processes to repeatedly execute malicious payloads as part of persistence. Additionally, the group favours techniques such as Process: OS API Execution (7%) and Network Traffic: Network Traffic Content (6%).
This information serves as a valuable input for monitoring and detection. However, it should be noted that due to the covert nature of the Lazarus group’s activities, there are likely additional tools and techniques that have yet to be discovered.
Figure 5 – When monitoring for Lazarus targeting data sources, these are the ones to watch
Looking at the available data, Hunt & Hackett recommends that an emphasis should be placed on endpoint monitoring to enable detection of malicious activities associated with Lazarus. Endpoints are devices such as computers, laptops, mobile devices, servers, and other network-connected devices that serve as entry or exit points for data in a network. Endpoint monitoring solutions leverage behavioural analysis and anomaly detection techniques to identify deviations from normal behaviour within the system, allowing malicious activity to be detected more efficiently. Collection and analysis of endpoint logs provides important information about process execution, command-line activity, and system events. By continuously monitoring endpoints, an organisation increases its chances of detecting and blocking unauthorized lateral movement before significant damage occurs.
Additionally, an emphasis should be placed on XDR log monitoring, where data is aggregated from a range of diverse sources to provide centralized visibility. This allows an organization's security team to correlate information across different environments, making it possible to detect sophisticated attack techniques, such as lateral movement or data exfiltration following Command Execution. Finally, Hunt & Hackett recommends monitoring network traffic and protocols. This can enable identification of (potentially) malicious patterns, commands, or requests associated with Command Execution and Process Creation.
Ultimately, it is important to recognize that effective detection capabilities must be acquired, developed, or customized to ensure comprehensive coverage against the Lazarus group’s sophisticated attacking techniques and broad toolset. This typically requires custom developed detection logic, which is particularly important when dealing with adversaries as stealthy and persistent as Lazarus.
.png?width=2033&height=600&name=amCharts(11).png)
Figure 3 – From Technique to Data Source to Detection