Lazarus Group
The Lazarus Group is not just another cybercriminal organization; it's a shadowy, state-sponsored hacking entity allegedly linked to the government of North Korea. Known for its remarkable evolution from simple digital sabotage to highly sophisticated global financial heists, this group has left a trail of digital destruction and stolen billions across the globe. Their relentless operations highlight a unique form of asymmetric warfare, where a small, dedicated unit can challenge global cybersecurity and economy alike. The Lazarus Group is a state-sponsored cyber warfare unit linked to North Korea, evolving from simple sabotage to sophisticated global financial theft. They employ diverse tactics, from DDoS attacks and ransomware like WannaCry to exploiting cryptocurrency platforms, constantly adapting to new targets and technologies. Operating through specialized sub-groups, the group's actions are often aimed at generating illicit revenue to circumvent international sanctions and fund North Korea's strategic programs.
AI Summary
The Lazarus Group is not just another cybercriminal organization; it's a shadowy, state-sponsored hacking entity allegedly linked to the government of North Korea. Known for its remarkable evolution from simple digital sabotage to highly sophisticated global financial heists, this group has left a trail of digital destruction and stolen billions across the globe. Their relentless operations highlight a unique form of asymmetric warfare, where a small, dedicated unit can challenge global cybersecurity and economy alike.
- The Lazarus Group is a state-sponsored cyber warfare unit linked to North Korea, evolving from simple sabotage to sophisticated global financial theft.
- They employ diverse tactics, from DDoS attacks and ransomware like WannaCry to exploiting cryptocurrency platforms, constantly adapting to new targets and technologies.
- Operating through specialized sub-groups, the group's actions are often aimed at generating illicit revenue to circumvent international sanctions and fund North Korea's strategic programs.
The Shadowy Hand of Lazarus
The Lazarus Group, also known by aliases like Guardians of Peace, Hidden Cobra, ZINC, or internally as the 414 Liaison Office, represents a formidable threat in the digital realm. Researchers have attributed a staggering number of cyberattacks to them since 2010, marking them as an Advanced Persistent Threat—an APT. This designation speaks to their long-term, sophisticated, and targeted nature.
These aren't just independent hackers; the United States Department of Justice alleges the group is an integral part of North Korea's strategy. Their mission? To undermine global cybersecurity, generate illicit revenue in defiance of international sanctions, and project an asymmetric threat against adversaries, particularly South Korea. It's a low-cost, high-impact form of warfare.
A History of Digital Aggression
The earliest known attack attributed to the group, "Operation Troy," unfolded between 2009 and 2012. This cyber-espionage campaign initially used unsophisticated distributed denial-of-service, or DDoS, techniques to barrage South Korean government websites. It was a chaotic, but telling, start to their evolving capabilities.
As time passed, their methods grew sharper. The "Ten Days of Rain" in 2011 and the "DarkSeoul" attacks of 2013 targeted South Korean media, financial institutions, and critical infrastructure with increasingly sophisticated DDoS and destructive 'wiper' attacks. This evolution showed a clear intent to disrupt and destroy.
The Hollywood Hack
Then came the attack that brought them global infamy: the 2014 hack on Sony Pictures. Operating under the name "Guardians of Peace," they siphoned off vast quantities of data—unreleased films, scripts, executive salaries, internal emails, and even the personal information of thousands of employees. It was a brazen act that shocked the entertainment industry.
Global Bank Heists
With their skills honed, the Lazarus Group set its sights on a new, lucrative target: financial institutions. In 2015, they reportedly stole $12 million from Banco del Austro in Ecuador and $1 million from Vietnam's Tien Phong Bank, extending their reach far beyond their regional focus. They also targeted banks in Poland and Mexico.
The most infamous financial operation was the 2016 Bangladesh Bank heist. Hackers issued 35 fraudulent instructions via the SWIFT network, attempting to steal nearly $1 billion. While most transactions were blocked due to a suspicious misspelling, a staggering $81 million still slipped through, vanishing into accounts in the Philippines and Sri Lanka. It was a sophisticated act of digital larceny on an unprecedented scale.
Cybersecurity firms like Kaspersky Lab began to unravel the group's structure, identifying a financially motivated sub-group called BlueNoroff. They found direct IP links to North Korea, yet also cautioned that code repetition could be a "false flag"—a deliberate attempt to mislead investigators and deflect blame.
The WannaCry Ransomware Epidemic
In May 2017, the world witnessed one of the most devastating cyberattacks in history: WannaCry. This massive ransomware cryptoworm swept across 150 countries, infecting nearly 200,000 computers, crippling institutions from Britain's National Health Service to Boeing and numerous universities. It exploited a critical vulnerability in Windows, spreading autonomously and rapidly across networks.
The virus encrypted victims' data, demanding a ransom in Bitcoin, typically around $300, which would double if not paid within three days. Fail to pay in a week, and your files would be deleted forever. The cryptoworm utilized the Windows Crypto software for encryption, but its rapid spread was fueled by two powerful exploits: EternalBlue, which moved it across networks, and DoublePulsar, which triggered its activation on infected machines.
In an unusual twist, a security researcher named Marcus Hutchins discovered a "kill switch" hardcoded into the malware. By registering a specific, unregistered domain name, he inadvertently halted WannaCry's global propagation. This, combined with the surprisingly low total ransom collected—only $160,000—led many to believe the attack's primary motive wasn't financial gain, but rather to cause widespread chaos and disruption.
Further investigation revealed that the DoublePulsar exploit was a cyberweapon developed by the US National Security Agency, later stolen and leaked by the Shadow Brokers hacker group. While Microsoft had issued a patch a month before the attack, most organizations hadn't updated their systems, leaving them vulnerable to WannaCry's devastating reach.
Ultimately, both the US Department of Justice and British authorities formally attributed the WannaCry attack to the Lazarus Group, cementing their reputation as a global cyber menace.
Crypto Crime Spree
As the world embraced digital currencies, so too did the Lazarus Group. From 2017 onward, they systematically targeted Bitcoin and Monero users, particularly in South Korea. Their tactics included exploiting vulnerabilities in South Korean software like Hancom Hangul and deploying spear-phishing lures to steal credentials from cryptocurrency exchange users.
The scale of their crypto heists is staggering. They've been blamed for stealing $7 million from Bithumb, causing another exchange, Youbit, to declare bankruptcy after losing 17% of its assets, and pilfering over 4,500 Bitcoin from Nicehash. More recently, the FBI confirmed their responsibility for the $620 million theft from Ronin Network (Axie Infinity), the $100 million from Harmony's Horizon Bridge, another $100 million from Atomic Wallet users, and a $41 million hack on Stake.com, an online casino.
Reports continue to emerge, with some industry analysts suggesting the Lazarus Group was behind the colossal February 2025 Bybit hack, where $1.5 billion worth of Ethereum was reportedly stolen—making it potentially the largest cryptocurrency exchange hack to date, if confirmed.
Targets of Opportunity
The group's opportunistic nature was starkly evident during the COVID-19 pandemic. They launched spear-phishing campaigns against pharmaceutical companies, posing as health officials to infiltrate networks and potentially steal sensitive vaccine research. AstraZeneca was a confirmed target, with motives likely ranging from selling stolen data for profit to providing intelligence to foreign regimes.
In January 2021, a highly sophisticated campaign emerged, directly targeting cybersecurity researchers themselves. The hackers created elaborate fake profiles on platforms like Twitter, GitHub, and LinkedIn, posing as legitimate vulnerability experts. Their goal was to engage researchers, offer collaboration, and then trick them into downloading malware or visiting malicious blog posts.
Alarmingly, some victims reported their computers were compromised even while using fully patched versions of Google Chrome, suggesting the hackers may have leveraged a previously unknown zero-day vulnerability. It was a chilling reminder that even those dedicated to digital defense can become targets.
Behind the Digital Curtain
North Korea's state-sponsored hacking capabilities are built on a robust, if secretive, educational pipeline. Talented individuals are reportedly sent to Shenyang, China, for specialized training, where they learn to deploy all manner of malware. Domestically, elite institutions like Kim Chaek University of Technology, Kim Il Sung University, and Moranbong University select the brightest students for six years of intensive cyber education.
Specialized Units: BlueNorOff
Within the Lazarus Group, BlueNorOff (also known as APT38, Stardust Chollima, or BeagleBoyz) stands out as the financially motivated arm. This unit, reportedly comprising about 1,700 members, specializes in illegal money transfers through methods like forging SWIFT orders and exploiting vulnerabilities in financial institutions and cryptocurrency exchanges. Their illicit gains are believed to directly fund North Korea's development of missile and nuclear technologies.
Specialized Units: AndAriel
Another significant subgroup is AndAriel (or Silent Chollima), estimated to have around 1,600 members. Their mission is predominantly focused on reconnaissance and network mapping, specifically targeting South Korean government, defense, and economic symbols. Their stealthy operations leverage various attack vectors, including vulnerabilities in South Korean software, watering hole attacks, and spear-phishing campaigns.
The Hunt for the Hackers
The international community is actively pursuing members of the Lazarus Group. In February 2021, the US Department of Justice indicted three individuals—Park Jin Hyok, Jon Chang Hyok, and Kim Il Park—allegedly part of North Korea's military intelligence agency, the Reconnaissance General Bureau. While these individuals remain at large, the US Treasury's Office of Foreign Assets Control has also placed Lazarus on its Specially Designated Nationals List, effectively sanctioning the group and its facilitators globally.
Article
Lazarus Group
The Lazarus Group (also known as the Guardians of Peace or Whois Team) is a state-sponsored hacker group made up of unknown members, alleged to be run by the government of North Korea. While not much is known about the group, researchers have attributed many cyberattacks to them since the 2010s.
Originally deemed as a clandestine criminal group, the group has now been designated as an advanced persistent threat due to its intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity organizations include Hidden Cobra (used by the United States Department of Homeland Security to refer to malicious cyber activity by the North Korean government in general), ZINC and Diamond Sleet (by Microsoft). According to North Korean defector Kim Kuk-song, the unit is known internally as the 414 Liaison Office.
The Lazarus Group has strong links to North Korea. The United States Department of Justice has claimed the group is part of the North Korean government's strategy to "undermine global cybersecurity ... and generate illicit revenue in violation of ... sanctions". North Korea benefits from conducting cyber operations because it can present an asymmetric threat with a small group of operators, especially to South Korea.
History
Lazarus Group
The earliest known attack that the group is responsible for is known as "Operation Troy", which took place from 2009 to 2012. This was a cyber-espionage campaign that utilized unsophisticated distributed denial-of-service attack (DDoS) techniques to target the South Korean government in Seoul. They were also responsible for attacks in 2011 and 2013. Though uncertain, it is possible that they were also behind a 2007 attack targeting South Korea. A notable attack that the group is known for is the 2014 attack on Sony Pictures. The Sony attack used more sophisticated techniques and highlighted how advanced the group has become over time.
FBI wanted notice for one of the hackers of the Lazarus Group, Park Jin Hyok
The Lazarus Group were reported to have stolen US$12 million from the Banco del Austro in Ecuador and US$1 million from Vietnam's Tien Phong Bank in 2015. They have also targeted banks in Poland and Mexico. The 2016 bank heist included an attack on the Bangladesh Bank, successfully stealing US$81 million and was attributed to the group. In 2017, the Lazarus group was reported to have stolen US$60 million from the Far Eastern International Bank of Taiwan although the actual amount stolen was unclear, and most of the funds were recovered.
It is not clear who is really behind the group, but media reports have suggested the group has links to North Korea. Kaspersky Lab reported in 2017 that Lazarus tended to concentrate on spying and infiltration cyberattacks whereas a sub-group within their organisation, which Kaspersky called Bluenoroff, specialised in financial cyberattacks. Kaspersky found multiple attacks worldwide and a direct link (IP address) between Bluenoroff and North Korea.
However, Kaspersky also acknowledged that the repetition of the code could be a "false flag" meant to mislead investigators and pin the attack on North Korea, given that the worldwide WannaCry worm cyber attack copied techniques from the NSA as well. This ransomware leverages an NSA exploit known as EternalBlue that a hacker group known as Shadow Brokers made public in April 2017. Symantec reported in 2017 that it was "highly likely" that Lazarus was behind the WannaCry attack.
2009 Operation Troy
The Lazarus Group's first major hacking incident took place on July 4, 2009, and sparked the beginning of "Operation Troy". This attack utilized the Mydoom and Dozer malware to launch a large-scale, but quite unsophisticated, DDoS attack against US and South Korean websites. The volley of attacks struck about three dozen websites and placed the text "Memory of the Independence Day" in the master boot record (MBR).
2013 South Korea Cyberattack (Operation 1Mission/ DarkSeoul)
Over time, attacks from this group have grown more sophisticated; their techniques and tools have become better developed and more effective. The March 2011 attack known as "Ten Days of Rain" targeted South Korean media, financial, and critical infrastructure, and consisted of more sophisticated DDoS attacks that originated from compromised computers within South Korea. The attacks continued on March 20, 2013, with DarkSeoul, a wiper attack that targeted three South Korean broadcast companies, financial institutes, and an ISP. At the time, two other groups going by the personas "NewRomanic Cyber Army Team and WhoIs Team", took credit for that attack but researchers did not know the Lazarus Group was behind it at the time. Researchers today know the Lazarus Group as a supergroup behind the disruptive attacks.
Late 2014: Sony breach
The Lazarus Group attacks culminated on November 24, 2014. On that day, a Reddit post appeared stating that Sony Pictures had been hacked via unknown means; the perpetrators identified themselves as the "Guardians of Peace". Large amounts of data were stolen and slowly leaked in the days following the attack. An interview with someone claiming to be part of the group stated that they had been siphoning Sony's data for over a year.
The hackers were able to access previously unreleased films, scripts for certain films, plans for future films, information about executive salaries at the company, emails, and the personal information of around 4,000 employees.
Early 2016 Investigation: Operation Blockbuster
Under the name "Operation Blockbuster", a coalition of security companies, led by Novetta, was able to analyse malware samples found in different cyber-security incidents. Using that data, the team was able to analyse the methods used by the hackers. They linked the Lazarus Group to a number of attacks through a pattern of code re-usage. For example, they used a little-known encryption algorithm available on the internet, the Caracachs cipher algorithm.
2016 Bangladesh Bank cyber heist
The Bangladesh Bank cyber heist was a theft that took place in February 2016. Thirty-five fraudulent instructions were issued by security hackers via the SWIFT network to illegally transfer close to US$1 billion from the Federal Reserve Bank of New York account belonging to Bangladesh Bank, the central bank of Bangladesh. Five of the thirty-five fraudulent instructions were successful in transferring US$101 million, with US$20 million traced to Sri Lanka and US$81 million to the Philippines. The Federal Reserve Bank of New York blocked the remaining thirty transactions, amounting to US$850 million, due to suspicions raised by a misspelled instruction. Cybersecurity experts claimed that the North Korea–based Lazarus Group was behind the attack.
May 2017 WannaCry ransomware attack
The WannaCry attack was a massive ransomware cyberattack that hit institutions across the globe ranging all the way from the NHS in Britain, to Boeing, and even to Universities in China on May 12, 2017. The attack lasted 7 hours and 19 minutes. Europol estimates it affected nearly 200,000 computers in 150 countries, primarily affecting Russia, India, Ukraine, and Taiwan. This was one of the first attacks of a cryptoworm. Cryptoworms are a class of malware that travels between computers using networks, without requiring direct user action for infection – in this case, exploiting TCP port 445. To be infected, there is no need to click on a bad link – the malware can spread autonomously, from a computer to a connected printer, and then beyond to adjacent computers, perhaps connected to the local network, etc. The port 445 vulnerability allowed the malware to move freely across intranets, and infect thousands of computers rapidly. It was also one of the first large scale uses of a cryptoworm.
Attack
The virus exploited a vulnerability in the Windows operating system, then encrypted the computer's data in return for a sum of Bitcoin worth roughly $300 to get the key. In order to encourage payment, the ransom demand doubled after three days, and if not paid in a week, the malware deletes the encrypted data files. The malware used a legitimate piece of software called Windows Crypto, made by Microsoft to scramble the files. Once the encryption is completed, the filename has "Wincry" appended, which is the root of the Wannacry name. Wincry was the base of the encryption, but two additional exploits, EternalBlue and DoublePulsar, were used by the malware to make it a cryptoworm. EternalBlue automatically spreads the virus through networks, while DoublePulsar triggered it to activate on a victim's computer. In other words, EternalBlue got the infected link to your computer, and DoublePulsar clicked it for you.
Security researcher Marcus Hutchins brought the attack to an end when he received a copy of the virus from a friend at a security research company and discovered a kill switch hardcoded into the virus. The malware included a periodic check to see if a specific domain name was registered, and would only proceed with encryption if that domain name did not exist. Hutchins identified this check, then promptly registered the relevant domain at 3:03 pm UTC. The malware immediately stopped propagating itself and infecting new machines. This was very interesting, and is a clue as to who created the virus. Usually stopping malware takes months of back and forth fighting between the hackers and security experts, so this easy win was unexpected. Another very interesting and unusual aspect of the attack was that the files were not recoverable after paying the ransom: only $160,000 was collected, leading many to believe that the hackers weren't after the money.
The easy kill switch and lack of revenue led many to believe that the attack was state-sponsored; the motive was not financial compensation, but just to cause chaos. After the attack security experts traced the DoublePulsar exploit back to the United States NSA where the exploit had been developed as a cyberweapon. The exploit was then stolen by the Shadow Brokers hacker group, who first tried to auction it off, but after failing to do that simply gave it away for free. The NSA subsequently revealed the vulnerability to Microsoft who issued an update on March 14, 2017, two months before the attack occurred. The update wasn't mandatory and the majority of computers with the vulnerability had not resolved the issue by the time May 12 rolled around, leading to the widespread impact of the attack.
Aftermath
The US Department of Justice and British authorities later attributed the WannaCry attack on the North Korean hacking gang, the Lazarus group.
2017 cryptocurrency attacks
In 2018, Recorded Future issued a report linking the Lazarus Group to attacks on cryptocurrency Bitcoin and Monero users mostly in South Korea. These attacks were reported to be technically similar to previous attacks using the WannaCry ransomware and the attacks on Sony Pictures. One of the tactics used by Lazarus hackers was to exploit vulnerabilities in Hancom's Hangul, a South Korean word processing software. Another tactic was to use spear-phishing lures containing malware and which were sent to South Korean students and users of cryptocurrency exchanges like Coinlink. If the user opened the malware it stole email addresses and passwords. Coinlink denied their site or users emails and passwords had been hacked. The report concluded that "This late-2017 campaign is a continuation of North Korea's interest in cryptocurrency, which we now know encompasses a broad range of activities including mining, ransomware, and outright theft ..." The report also said that North Korea was using these cryptocurrency attacks to avoid international financial sanctions.
North Korean hackers stole US$7 million from Bithumb, a South Korean exchange in February 2017. Youbit, another South Korean Bitcoin exchange company, filed for bankruptcy in December 2017 after 17% of its assets were stolen by cyberattacks following an earlier attack in April 2017. Lazarus and North Korean hackers were blamed for the attacks. Nicehash, a cryptocurrency cloud mining marketplace lost over 4,500 Bitcoin in December 2017. An update about the investigations claimed that the attack is linked to the Lazarus Group.
September 2019 attacks
In mid-September 2019, the USA issued a public alert about a new version of malware dubbed ElectricFish. Since the beginning of 2019, North Korean agents have attempted five major cyber-thefts world-wide, including a successful $49 million theft from an institution in Kuwait.
Late 2020 pharmaceutical company attacks
Due to the ongoing COVID-19 pandemic, pharmaceutical companies became major targets for the Lazarus Group. Using spear-phishing techniques, Lazarus Group members posed as health officials and contacted pharmaceutical company employees with malicious links. It is thought that multiple major pharma organizations were targeted, but the only one that has been confirmed was the Anglo-Swedish-owned AstraZeneca. According to a report by Reuters, a wide range of employees were targeted, including many involved in COVID-19 vaccine research. It is unknown what the Lazarus Group's goal was in these attacks, but the likely possibilities include:
• Stealing sensitive information to be sold for profit. • Extortion schemes. • Giving foreign regimes access to proprietary COVID-19 research.
AstraZeneca has not commented on the incident and experts do not believe any sensitive data has been compromised as of yet.
January 2021 attacks targeting cybersecurity researchers
In January 2021, Google and Microsoft both publicly reported on a group of North Korean hackers targeting cybersecurity researchers via a social engineering campaign, with Microsoft specifically attributing the campaign to the Lazarus Group.
The hackers created multiple user profiles on Twitter, GitHub, and LinkedIn posing as legitimate software vulnerability researchers, and used those profiles to interact with posts and content made by others in the security research community. The hackers would then target specific security researchers by contacting them directly with an offer to collaborate on research, with the goal of getting the victim to download a file containing malware, or to visit a blog post on a website controlled by the hackers.
Some victims who visited the blog post reported that their computers were compromised despite using fully patched versions of the Google Chrome browser, suggesting that the hackers may have used a previously unknown zero-day vulnerability affecting Chrome for the attack; however, Google stated that they were unable to confirm the exact method of compromise at the time of the report.
March 2022 online game Axie Infinity attack
In March 2022, the Lazarus Group was found responsible for stealing $620 million worth of cryptocurrencies from the Ronin Network, a bridge used by the Axie Infinity game. The FBI said "Through our investigations we were able to confirm the Lazarus Group and APT38, cyber actors associated with [North Korea], are responsible for the theft".
June 2022 Horizon Bridge attack
The FBI confirmed that the North Korean malicious cyber actor group Lazarus (also known as APT38) was responsible for the theft of $100 million of virtual currency from Harmony's Horizon bridge reported on June 24, 2022.
2023 cryptocurrency attacks
A report published by blockchain security platform Immunefi, alleged that Lazarus was responsible for over $300 million in losses across crypto hacking incidents in 2023. The amount represents 17.6% of the year's total losses.
June 2023 Atomic Wallet attack
In June 2023 over $100 million in cryptocurrency was stolen from users of the Atomic Wallet service, and this was later confirmed by the FBI.
September 2023 Stake.com hack
In September 2023, the FBI confirmed that a $41 million theft of cryptocurrency from Stake.com, an online casino and betting platform, was perpetrated by the Lazarus Group.
U.S. sanctions
On 14 April 2022, the US Treasury's OFAC placed Lazarus on the SDN List under North Korea Sanctions Regulations section 510.214.
Cryptocurrency transfer
Between June 2023 and February 2024, Huione Pay, whose directors include Cambodian businessman Hun To, received cryptocurrency worth over $150,000, from a digital wallet used by North Korean hacking outfit Lazarus, according to the previously unreported blockchain data reviewed by Reuters.
Cryptocurrency exchange hacks
According to Indian media reports, a local cryptocurrency exchange named WazirX was hacked by the group and $234.9 million worth of crypto assets have been stolen.
In February 2025, the cryptocurrency exchange Bybit, based in Dubai, was hacked in what became the biggest crypto exchange theft to date. Around 400,000 Ethereum was stolen, worth about US$1.5 billion at the time. The attackers gained access to Bybit's cold wallet system by exploiting a vulnerability in a third-party wallet tool called Safe {Wallet}. According to reports, they tricked wallet signers into approving a fake transaction that gave them control over the funds.
The hack caused a sharp drop in cryptocurrency prices. Ethereum fell by over 20%, and Bitcoin dropped below US$90,000. Many users rushed to withdraw their funds, and some exchanges temporarily paused withdrawals. Regulators in several countries began reviewing how exchanges secure user assets.
Cybersecurity researchers and blockchain analysts linked the attack to the Lazarus Group, a hacking group believed to be backed by North Korea. They tracked the stolen funds through multiple wallets and exchanges and found patterns similar to previous Lazarus operations.
Bybit stated that it was able to recover most of the stolen Ethereum and remained solvent throughout the incident. The company announced new security upgrades and offered a bounty to help track down the hackers and recover the remaining funds.
Education
Lazarus Group
North Korean hackers are sent vocationally to Shenyang, China for special training. They are trained to deploy malware of all types onto computers, computer networks, and servers. Education domestically includes the Kim Chaek University of Technology, Kim Il Sung University and Moranbong University, which picks the brightest students from across the country and puts them through six years of special education. Beyond the university level, "some of the brightest programmers ... are sent to Moranbong University or Mirim College."
Units
BlueNorOff
BlueNorOff (also known as: APT38, Stardust Chollima, BeagleBoyz, NICKEL GLADSTONE) is a financially motivated group that is responsible for the illegal transfers of money via forging orders from SWIFT. BlueNorOff is also called APT38 (by Mandiant) and Stardust Chollima (by Crowdstrike).
According to a 2020 report by the U.S. Army, Bluenoroff has about 1,700 members carrying out financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities and systems for financial gain for the regime or to take control of the system. They target financial institutions and cryptocurrency exchanges, including over 16 organizations in at least 13 countries between 2014 and 2021: Bangladesh, Chile, India, Mexico, Pakistan, the Philippines, South Korea, Taiwan, Turkey, and Vietnam. The revenue is believed to go towards the development of missile and nuclear technology.
BlueNorOff's most infamous attack was the 2016 Bangladesh Bank robbery in which they tried to use the SWIFT network to illegally transfer close to US$1 billion from the Federal Reserve Bank of New York account belonging to Bangladesh Bank, the central bank of Bangladesh. After several of the transactions went through (US$20 million traced to Sri Lanka and US$81 million to the Philippines), the Federal Reserve Bank of New York blocked the remaining transactions, due to suspicions raised by a misspelling.
Malware associated with BlueNorOff include: "DarkComet, Mimikatz, Nestegg, Macktruck, WannaCry, Whiteout, Quickcafe, Rawhide, Smoothride, TightVNC, Sorrybrute, Keylime, Snapshot, Mapmaker, net.exe, sysmon, Bootwreck, Cleantoad, Closeshave, Dyepack, Hermes, Twopence, Electricfish, Powerratankba, and Powerspritz"
Tactics commonly used by BlueNorOff include: phishing, backdoors, Drive-by compromise, Watering hole attack, exploitation of insecure out-of-date versions of Apache Struts 2 to execute code on a system, strategic web compromise, and accessing Linux servers. It's reported that they sometimes work together with criminal hackers.
AndAriel
AndAriel (also spelled Andarial, and also known as: Silent Chollima, Dark Seoul, Rifle, and Wassonite) is logistically characterized by its targeting of South Korea. AndAriel's alternative name is called Silent Chollima due to the stealthy nature of the subgroup. Any organization in South Korea is vulnerable to AndAriel. Targets include government, defense, and any economic symbol.
According to a 2020 report by the U.S. Army, Andarial has about 1,600 members whose mission is reconnaissance, assessment of the network vulnerabilities, and mapping the enemy network for potential attack. In addition to South Korea, they also target other governments, infrastructure, and businesses. Attack vectors include: ActiveX, vulnerabilities in South Korean software, watering hole attacks, spear phishing (macro), IT management products (antivirus, PMS), and supply chain (installers and updaters). Malware used include: Aryan, Gh0st RAT, Rifdoor, Phandoor, and Andarat.
Indictments
Lazarus Group
In February 2021, the US Department of Justice indicted three members of the Reconnaissance General Bureau, a North Korean military intelligence agency, for having participated in several Lazarus hacking campaigns: Park Jin Hyok, Jon Chang Hyok and Kim Il Park. Jin Hyok had already been indicted earlier in September 2018. The individuals are not in U.S. custody. A Canadian and two Chinese individuals have also been charged with having acted as money mules and money launderers for the Lazarus group.