Home/ Threat Actors/ Lazarus Group

🇰🇵Lazarus Group

🇰🇵 Lazarus Group is a tracked threat actor in the Clankerusecase corpus. Attributed to KP. Primary motivation: State. We map 26 detection use cases to this actor across 147 MITRE ATT&CK techniques, with 5 threat-intel articles citing them. Active in our corpus from 2025-10-23 to 2026-05-28.

crit 5

View full actor card → All threat actors MITRE ATT&CK group spec (G0032) ↗

26Use cases

5Articles

147Techniques

32IOCs

Known aliases

LazarusLazarus GroupHidden CobraGuardians of PeaceZINCDiamond SleetLabyrinth ChollimaHIDDEN COBRANICKEL ACADEMY

Top techniques

T1190 · Exploit Public-Facing Application T1204.002 · Malicious File T1059.001 · PowerShell

All other tracked techniques

T1001.003 · Protocol or Service Impersonation T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1005 · Data from Local System T1008 · Fallback Channels T1010 · Application Window Discovery T1012 · Query Registry T1016 · System Network Configuration Discovery T1020 · Automated Exfiltration T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.004 · SSH T1027 · Obfuscated Files or Information T1027.007 · Dynamic API Resolution T1027.009 · Embedded Payloads T1027.013 · Encrypted/Encoded File T1033 · System Owner/User Discovery T1036.003 · Rename Legitimate Utilities T1036.004 · Masquerade Task or Service T1036.005 · Match Legitimate Resource Name or Location T1041 · Exfiltration Over C2 Channel T1046 · Network Service Discovery T1047 · Windows Management Instrumentation T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol T1049 · System Network Connections Discovery T1053.005 · Scheduled Task T1055 · Process Injection T1055.001 · Dynamic-link Library Injection T1056.001 · Keylogging T1057 · Process Discovery T1059.003 · Windows Command Shell T1059.005 · Visual Basic T1059.007 · JavaScript T1070 · Indicator Removal T1070.003 · Clear Command History T1070.004 · File Deletion T1070.006 · Timestomp T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1074.001 · Local Data Staging T1078 · Valid Accounts T1082 · System Information Discovery T1083 · File and Directory Discovery T1090 · Proxy T1090.001 · Internal Proxy T1090.002 · External Proxy T1098 · Account Manipulation T1102 · Web Service T1102.002 · Bidirectional Communication T1104 · Multi-Stage Channels T1105 · Ingress Tool Transfer T1106 · Native API T1110.003 · Password Spraying T1112 · Modify Registry T1113 · Screen Capture T1115 · Clipboard Data T1119 · Automated Collection T1124 · System Time Discovery T1125 · Video Capture T1129 · Shared Modules T1132.001 · Standard Encoding T1134.002 · Create Process with Token T1140 · Deobfuscate/Decode Files or Information T1189 · Drive-by Compromise T1195.002 · Compromise Software Supply Chain T1202 · Indirect Command Execution T1203 · Exploitation for Client Execution T1204.001 · Malicious Link T1204.004 · Malicious Copy and Paste T1218 · System Binary Proxy Execution T1218.005 · Mshta T1218.010 · Regsvr32 T1218.011 · Rundll32 T1219 · Remote Access Tools T1406 · T1406 T1407 · T1407 T1420 · T1420 T1422 · T1422 T1426 · T1426 T1429 · T1429 T1430 · T1430 T1437.001 · T1437.001 T1474.003 · T1474.003 T1480.001 · Environmental Keying T1481.002 · T1481.002 T1485 · Data Destruction T1486 · Data Encrypted for Impact T1489 · Service Stop T1491.001 · Internal Defacement T1497 · Virtualization/Sandbox Evasion T1513 · T1513 T1529 · System Shutdown/Reboot T1532 · T1532 T1533 · T1533 T1541 · T1541 T1542.003 · Bootkit T1543.003 · Windows Service T1546.016 · Installer Packages T1547.001 · Registry Run Keys / Startup Folder T1547.009 · Shortcut Modification T1553.002 · Code Signing T1555 · Credentials from Password Stores T1555.003 · Credentials from Web Browsers T1557.001 · Name Resolution Poisoning and SMB Relay T1560 · Archive Collected Data T1560.002 · Archive via Library T1560.003 · Archive via Custom Method T1561.001 · Disk Content Wipe T1561.002 · Disk Structure Wipe T1564.001 · Hidden Files and Directories T1564.003 · Hidden Window T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link T1566.003 · Spearphishing via Service T1567.002 · Exfiltration to Cloud Storage T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1571 · Non-Standard Port T1573.001 · Symmetric Cryptography T1574.001 · DLL T1574.002 · T1574.002 T1574.013 · KernelCallbackTable T1583.001 · Domains T1583.006 · Web Services T1584.004 · Server T1585.001 · Social Media Accounts T1585.002 · Email Accounts T1585.003 · Cloud Accounts T1587.001 · Malware T1588.002 · Tool T1588.004 · Digital Certificates T1589.002 · Email Addresses T1591 · Gather Victim Org Information T1608.001 · Upload Malware T1620 · Reflective Code Loading T1636.002 · T1636.002 T1636.003 · T1636.003 T1636.004 · T1636.004 T1646 · T1646 T1680 · Local Storage Discovery T1685 · Disable or Modify Tools T1686.003 · Windows Host Firewall

Detection use cases (26)

Lazarus 'Contagious Interview' — node.exe spawning curl/python loader for BeaverTail/InvisibleFerret AI · profile SΣDD Lazarus Operation Dream Job — DLL side-loaded by legitimate signed host executed from user-writable path AI · profile SΣDD Trojanized axios npm package postinstall: node.exe spawned from plain-crypto-js dependency Bespoke axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke axios RAT C2 callout to sfrclak.com / 142.11.206.73:8000 Bespoke Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal Remote service execution — PsExec / SMB lateral movement Internal Trusted vendor binary / installer launching unusual children Internal Kimsuky HelloDoor 'tdll' Run-key persistence with regsvr32 loader Bespoke Kimsuky httpMalice persistence: 'Everything 1.9a-/1.8a-' Run-key or CacheDB service install Bespoke 1Password impossible-travel sign-in MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay MITRE match

Threat-intel articles (5)

crit ESET APT Activity Report Q4 2025–Q1 2026 · 2026-05-28

crit Kimsuky targets organizations with PebbleDash-based tools · 2026-05-14

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack · 2026-05-05

crit ESET APT Activity Report Q2 2025–Q3 2025 · 2025-11-06

crit Gotta fly: Lazarus targets the UAV sector · 2025-10-23

Tracked indicators

Domains (18)

anvil.org.ph bandarpowder.com coralsunmarine.com ecudecode.mx female-disorder-beta-met galaterrace.com kazitradebd.com mediostresbarbas.com.ar mnmathleague.org oldlinewoodwork.com partnerls.pl pierregems.com scgestor.com.br spaincaramoon.com sqgame.com.cn sqgame.net trainingpharmacist.co.uk xiazai.sqgame.com.cn

IP addresses (14)

104.21.80.1 104.247.162.67 108.181.92.71 152.42.239.211 172.67.193.139 185.148.129.24 193.39.187.165 23.111.133.162 45.148.29.122 66.29.144.75 70.32.24.131 75.102.23.3 77.55.252.111 95.217.119.214

CVEs (2)

CVE-2024-42009 CVE-2025-8088