Lazarus Group

A North Korean state-linked threat group known for a blend of espionage, cyber-crime, and destructive operations. This group was behind major incidents, including the Sony Pictures hack and the WannaCry ransomware outbreak. Highly resourced, adaptive, and capable across financial theft, supply-chain compromise, and espionage.

‍

Key behaviours to watch:

Spear-phishing delivering custom loaders (e.g., Manuscrypt, AppleJeus) for credential theft and remote access.
Long-term persistence using DLL side-loading, scheduled tasks, and compromised VPN accounts.
Financial operations involving crypto-exchange compromise, mixer abuse, and multi-stage laundering chains.