Loading story…
Mandiant published research linking prominent North Korean cyber activity to specific state organizations, arguing that multiple DPRK threat clusters commonly grouped under broad labels such as Lazarus are better understood as distinct teams aligned to different government entities. The report maps operations to the Reconnaissance General Bureau (RGB) and other North Korean institutions, and says the country’s cyber apparatus supports intelligence collection, financial theft, disruptive attacks, and strategic espionage.
The assessment highlights how umbrella naming has obscured operational differences among DPRK actors, including variations in targeting, tooling, and mission sets. By tying intrusion groups to government structures rather than relying only on overlapping malware or public aliases, Mandiant says defenders can improve attribution, track campaigns more accurately, and better understand how North Korea organizes cyber operations in support of state objectives.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant released a report titled "Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations," presenting attribution analysis linking North Korean cyber threat groups to specific government entities.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kudelski Security and Sekoia assess that the former **Lazarus** umbrella should be treated as six distinct DPRK-linked clusters: **TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima**. The groups differ in tradecraft and mission, conducting espionage, destructive activity, ransomware, bank theft, cryptocurrency theft, and sanctions-evasion operations rather than operating as a single monolithic actor. The assessment identifies the General Reconnaissance and Information Bureau (**GRIB**, formerly RGB) as North Korea’s principal offensive cyber organization, supported by intelligence bodies, party oversight, overseas intermediaries, and frequently reorganized units. It also highlights fake IT-worker schemes, front companies, academic exchanges, and infrastructure across China, Russia, Southeast Asia, and parts of Africa that help generate revenue, enable access, and launder proceeds; organizations should therefore track the six clusters separately and strengthen controls against identity fraud, insider-risk hiring, and cryptocurrency-focused intrusion campaigns.
Sep 10, 2026
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026