Loading story…
Kudelski Security and Sekoia assess that the former Lazarus umbrella should be treated as six distinct DPRK-linked clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima. The groups differ in tradecraft and mission, conducting espionage, destructive activity, ransomware, bank theft, cryptocurrency theft, and sanctions-evasion operations rather than operating as a single monolithic actor.
The assessment identifies the General Reconnaissance and Information Bureau (GRIB, formerly RGB) as North Korea’s principal offensive cyber organization, supported by intelligence bodies, party oversight, overseas intermediaries, and frequently reorganized units. It also highlights fake IT-worker schemes, front companies, academic exchanges, and infrastructure across China, Russia, Southeast Asia, and parts of Africa that help generate revenue, enable access, and launder proceeds; organizations should therefore track the six clusters separately and strengthen controls against identity fraud, insider-risk hiring, and cryptocurrency-focused intrusion campaigns.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
The DPRK's Ministry of State Security was renamed the National Intelligence Agency; the assessment says the change may indicate expanded foreign-intelligence responsibilities.
Moonstone Sleet used the Qilin ransomware-as-a-service platform in addition to its custom malware operations.
The approximately $1.5 billion Bybit theft is cited as an example of DPRK-linked cryptocurrency theft.
Funds stolen in the 2024 Munchables theft were returned after the actors encountered laundering difficulties. The report links probable DPRK IT workers to the theft.
Moonstone Sleet deployed FakePenny custom malware as part of its combined cyberespionage and financially motivated activity.
Andariel was observed collaborating with the Play ransomware operation; the cluster also used the Maui and H0lyGh0st ransomware families.
Identified DPRK IT-worker communications shifted from formal Korean to English around October 2022, which the report assesses was intended to make the workers less distinctive.
The Kudelski Security and Sekoia TDR research associates North Korea-linked operations with the WannaCry campaign.
The 2016 Bangladesh Bank heist resulted in the theft of $101 million and is cited as an example of DPRK-linked financially motivated cyber activity.
Kimsuky used wiper components during the breach of Korea Hydro and Nuclear Power, according to the report.
The report attributes the Sony Pictures hack to Lazarus-associated activity.
The report attributes Operation DarkSeoul to Lazarus-associated activity.
The Reconnaissance General Bureau (RGB), later known as GRIB, was formed through the merger of the Korean People's Army Reconnaissance Bureau, the Korean Workers' Party Operations Department, and overseas intelligence functions from Office 35.
Sekoia and Kudelski Security published an assessment separating the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima. The model differentiates the clusters by tactics, techniques, procedures, and operational objectives.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceinfosec.pub
Open sourceinfosecurity-magazine.com
Open sourcesekoia.com
Open sourcekudelskisecurity.com
Open sourcejstor.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026
Mandiant published research linking prominent North Korean cyber activity to specific state organizations, arguing that multiple DPRK threat clusters commonly grouped under broad labels such as **Lazarus** are better understood as distinct teams aligned to different government entities. The report maps operations to the **Reconnaissance General Bureau (RGB)** and other North Korean institutions, and says the country’s cyber apparatus supports intelligence collection, financial theft, disruptive attacks, and strategic espionage. The assessment highlights how umbrella naming has obscured operational differences among DPRK actors, including variations in targeting, tooling, and mission sets. By tying intrusion groups to government structures rather than relying only on overlapping malware or public aliases, Mandiant says defenders can improve attribution, track campaigns more accurately, and better understand how North Korea organizes cyber operations in support of state objectives.
Jul 12, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026