Loading threat actor…
Lazarus Group is a North Korean state-sponsored threat actor associated with cyberespionage and financially motivated operations against organizations worldwide. Its targets include financial and cryptocurrency businesses, information technology and cybersecurity companies, defense firms, healthcare organizations, engineering companies, and energy infrastructure. Lazarus is tracked under names including Hidden Cobra, ZINC, Diamond Sleet, Labyrinth Chollima, Guardians of Peace, TEMP.Hermit, Nickel Academy, Black Artemis, Selective Pisces, TA404, and APT-C-26. These designations can cover overlapping activity rather than precisely equivalent operational units. Lazarus uses targeted social engineering, malicious Microsoft Word attachments, recruitment-themed lures, and malicious software packages imitating legitimate components to obtain access. Associated recruitment activity includes Operation Dream Job and the UNC2970 cluster, which uses AI-assisted open-source research to profile employees at defense and cybersecurity firms and develop tailored phishing personas. Famous Chollima-associated operations infiltrate companies through fraudulent remote IT employment, using automated applications and interviews, VPN services, and legitimate remote-desktop software to obtain access to corporate accounts and workstations. Its malware supports Windows and macOS operations. Documented techniques include runtime payload decryption, manual in-memory loading, reflective DLL injection, command-shell execution, masquerading, and encrypted or obfuscated payloads. Lazarus maintains persistence through startup mechanisms, scheduled tasks, and Windows services. It has exploited CVE-2021-21551 in a vulnerable Dell driver to deploy a Windows rootkit, demonstrating bring-your-own-vulnerable-driver techniques. Other documented behaviors include administrator-account manipulation and RDP-based propagation. Lazarus-associated activity also includes malicious imitation of a VMware vSphere connector module, illustrating its use of software-supply-chain attack vectors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
95 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
78 malware families attributed to this actor across reporting.
73 additional families tracked in Mallory.
32 CVEs this actor has used in observed campaigns. 32 of them exploited in the wild.
Today, August 25, 2026, is the CISA KEV deadline requiring all Federal Civilian Executive Branch agencies to patch CVE-2026-68820, the underlying Windows WinSock driver flaw that ShieldBreak (CVE-2026-69414) bypasses. Check Point Research this week formally attributed exploitation of CVE-2026-68820 to North Korea's Lazarus Group as part of Operation Dream Job, where the group distributed a malicious PDF viewer called SecurityPDF to aerospace and defence targets alongside fake job offer lures, using the driver flaw to escalate from initial access to full SYSTEM privileges.
Lazarus compromet des installations Roundcube et des CMS vulnérables à CVE-2025-49113, en utilisant des identifiants issus de fuites sur le dark web.
Le groupe nord-coréen Lazarus a exploité CVE-2021-21551 (pilote Dell dbutil) pour déployer un rootkit Windows.
HIDDEN COBRA is known to use vulnerabilities affecting various applications. These vulnerabilities include: CVE-2016-0034: Microsoft Silverlight 5.1.41212.0 Vulnerability.
In early June, researchers discovered that the Lazarus group was exploiting a security flaw in Windows' AFD.sys driver to access sensitive system areas. The attackers also used Fudmodule malware to hide their activities from security software.
27 more CVEs tied to this actor tracked in Mallory.
5,522 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced solely in criticism of overly broad attribution labels for North Korean operations. The article does not attribute the reported campaign to Lazarus.
Attributed responsibility for the $1.4 billion Bybit exploit. The article cites funds from that theft indirectly reaching Cryptomus and Heleket as an example of the processors’ exposure to illicit activity.
Cited as a historical example of attacks exploiting Dell vulnerabilities. The content describes exploitation of the Dell dbutil driver to deploy a Windows rootkit, not exploitation of the newly disclosed DSU or CSM vulnerabilities.
Mentioned as abusing a vulnerable Intel Ethernet diagnostics driver to disable endpoint detection and response (EDR). The content does not attribute the analyzed AI-analysis evasion malware to Lazarus.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.