Lazarus Group
Lazarus Group is a North Korea-attributed nation-state APT group with a financial motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 45 countries, including the United States and the United Kingdom. It uses 217 MITRE ATT&CK techniques and exploits 39 known CVEs.
- Origin
- North Korea
- Techniques
- 217
- Exploited CVEs
- 39
- First seen
- Jan 1, 2009
- Last seen
- Mar 31, 2026
- Record updated
Who They Target.
About Lazarus Group.
Lazarus Group (APT38) is an APT/Nation State group sponsored by the North Korean Reconnaissance General Bureau (RGB), with operational sub-units including Lab 110, Bureau 121, and Unit 180. Active since 2009, the group is primarily motivated by financial gain, funding the regime's nuclear and ballistic missile programs, while maintaining strategic espionage operations against United States and South Korean government and defense institutions. It targets cryptocurrency exchanges, DeFi platforms, software supply chains (npm), and high-value individuals in the crypto industry globally. The group operates with strategic sophistication, demonstrated by the February 2025 ByBit heist (USD 1.5 billion stolen via blind-signature manipulation of the Safe{Wallet} multi-sig supply chain), the March 2026 Axios npm package compromise via the SILKBELL dropper, and the operational use of LLMs (Gemini, GPT-4o) and deepfake/meeting-lure social engineering.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.