Threat Actor ProfileLazarus

In late 2021, an unnamed aerospace company in the Netherlands was targeted by one of the Lazarus group’s trademark recruitment scams. An employee was contacted by individuals posing as Amazon recruiters and lured into opening malicious documents sent via email and LinkedIn. Upon opening, various tools including droppers, loaders, and HTTP(S) backdoors were deployed on the victim’s systems. One notable aspect of this campaign was the group’s use of a user-mode component to exploit the CVE-2021-21551 vulnerability in a legitimate Dell driver, from which kernel memory could be written, marking the first recorded abuse of this vulnerability in the wild. The attackers leveraged their kernel memory write access to disable key Windows monitoring mechanisms, including registry tracking, file system monitoring, and event tracing. This effectively blinded security solutions, allowing Lazarus to roam freely without detection Such a sophisticated approach again highlights the group’s ability to conduct deep research and develop advanced exploitation techniques. 

At Hunt & Hackett, we have observed the use of these techniques by Lazarus firsthand. In one of our previous investigations, we observed Lazarus sending highly targeted spear phishing messages disguised as job offers via the online messaging platform Telegram. As was the case with their 2021 campaign, tools such as loaders and backdoors were dropped onto the victim’s system once the malicious documents were opened.  

The Netherlands was not the only country targeted in this particular operation. Research by ESET shows that this was part of a broader effort to steal valuable information from defense companies in France, Italy, Germany, Poland, Ukraine, Turkey, Qatar and Brazil. Lazarus has repeatedly targeted the defense sector over the years, likely driven by North Korea’s enduring obsession with military supremacy. The regime continues to utilize the Songun (military-first) policy framework enacted by Kim Jong Il in 1995, which prioritizes the Korean People’s Army (KPA) as the central institution of North Korean society. Under Songun, the military is given the highest priority in resource allocation and national affairs, as it is seen as the primary force for safeguarding the regime. Over the past 15 years, the North Korea has become increasingly dependent on APTs like Lazarus to support its military ambitions.

In recent years, the Lazarus Group has become the focus of international legal action. In September 2018, the US Department of Justice charged suspected Lazarus Group member Park Jin Hyok for his involvement in the WannaCry ransomware attacks, the Sony Pictures breach, and other cybercrimes. According to the affidavit, Park was charged with conspiring to gain unauthorized access to computers, obtaining information with intent to defraud, causing damage, extortion related to computer intrusion, and wire fraud. In February 2021, a US federal indictment expanded on these charges, implicating two additional members - Jon Chang-Hyok, Kim Il - in a criminal conspiracy to conduct destructive cyberattacks, steal and extort over $1.3 billion from financial institutions and companies, create and deploy malicious cryptocurrency applications, and fraudulently market a blockchain platform.

Individuals affiliated with the Lazarus group have also come under scrutiny. In 2021, Canadian-American citizen Ghaleb Alaumary pled guilty to aiding the Lazarus Group in laundering money obtained through ATM cash-out operations. In 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the virtual currency mixer Blender.io for aiding the Lazarus Group in laundering stolen virtual currency. This followed the group’s largest virtual currency heist to date, worth nearly $620 million, from a blockchain project linked to the online game Axie Infinity. Blender.io is believed to have processed more than $20.5 million of the illicit proceeds.  In the same year, the US sanctioned cryptocurrency mixer Tornado Cash for allowing the proceeds of cybercrime to be laundered on its platform, including nearly half a billion dollars stolen by Lazarus.

The same year, US cryptocurrency researcher Virgil Griffith was sentenced to more than five years in prison for conspiring to help North Korea evade US sanctions using cryptocurrency. Griffith, who formerly worked for the Ethereum Foundation, traveled to North Korea in 2019 to speak at the Pyongyang Blockchain and Cryptocurrency Conference, despite being denied permission by the US Department of State to do so. US prosecutors said Griffith was aware the information he provided could be used to circumvent sanctions imposed on North Korea due to its nuclear weapons development. While speaking at the conference, Griffith stated: “The most important feature of blockchains is that they are open. And the DPRK [Democratic People's Republic of Korea] can't be kept out no matter what the USA or the UN says.” This assessment, unfortunately, turned out to be correct. In the years that followed, Lazarus shifted focus from financial institutions to cryptocurrency platforms, stealing an estimated $3 billion over the course of 58 attacks. UN sanction monitors believe these proceeds were used to further develop North Korea’s nuclear weapons program.