07-09-2026
Beyond Lazarus: Organization of DPRK cyber capabilities
https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities
Report completeness: Low
Actors/Campaigns:
Lazarus (motivation: financially_motivated, cyber_espionage, sabotage)
Kimsuky (motivation: cyber_espionage)
Andariel (motivation: cyber_espionage)
Applejeus
Tradertraitor (motivation: financially_motivated, cyber_espionage)
Moonstone_sleet (motivation: cyber_espionage)
Famous_chollima
Cryptocore (motivation: financially_motivated, cyber_espionage)
Konni (motivation: cyber_espionage)
Operation_blockbuster (motivation: cyber_espionage)
Bluenoroff (motivation: financially_motivated, cyber_espionage)
Contagious_interview
Threats:
Wannacry
Reaper
Killdisk
H0lygh0st
Fakepenny
Qilin_ransomware
Smuggling_technique
Victims:
Cryptocurrency industry, Financial institutions, Government entities, Academic experts, News media, Defectors, Activists, Non governmental organizations, Private entities, Blockchain projects, have more...
Industry:
Ngo, Financial, Nuclear_power, Education, Government, Entertainment, Military
Geo:
South korean, Korean, North korean, Japanese, North koreans, Myanmar, Thailand, Cambodia, Iraq, Chinese, North korea, Moscow, Russia, United states, Africa, American, Bangladesh, Nigeria, Japan, Russian, South korea, Korea, China, Dprk, Tanzania, Republic of korea, Asia, Russian federation, Guinea, Laos, African, Ukraine
ChatGPT TTPs:
do not use without manual checkT1036, T1090, T1090.002, T1213, T1485, T1486, T1498, T1561, T1587.001, T1588.001, have more...
IOCs:
IP: 13
Soft:
Slack
Wallets:
bybit
Win API:
Hermit
