14-09-2026
Beyond Lazarus: Organization of DPRK Cyber Capabilities
https://kudelskisecurity.com/research/beyond-lazarus-organization-of-dprk-cyber-capabilities
Report completeness: Low
Actors/Campaigns:
Lazarus (motivation: sabotage, financially_motivated, cyber_espionage)
Applejeus
Tradertraitor (motivation: financially_motivated, cyber_espionage)
Moonstone_sleet (motivation: cyber_espionage)
Famous_chollima
Cryptocore (motivation: financially_motivated, cyber_espionage)
Kimsuky (motivation: cyber_espionage)
Konni (motivation: cyber_espionage)
Operation_blockbuster (motivation: cyber_espionage)
Bluenoroff (motivation: financially_motivated, cyber_espionage)
Andariel (motivation: cyber_espionage)
Contagious_interview
Threats:
Wannacry
Killdisk
H0lygh0st
Fakepenny
Qilin_ransomware
Stylesmuggler_vuln
Victims:
Financial services, Cryptocurrency industry, Blockchain projects, Government, Defectors, Activists, Non governmental organizations, Dprk experts, Information technology sector, Media and entertainment, have more...
Industry:
Education, Military, Government, Ngo, Nuclear_power, Entertainment, Financial
Geo:
Thailand, Laos, Bangladesh, Russian, United states, South korean, China, Republic of korea, Russian federation, Dprk, Ukraine, Russia, Nigeria, Myanmar, North korea, Tanzania, South korea, North korean, African, Iraq, Moscow, American, Korea, Japanese, Korean, North koreans, Africa, Japan, Cambodia, Chinese, Guinea, Asia
CVEs:
CVE-2026-75650 [Vulners]
CVSS V3.1: 10.0,
Vulners: Exploitation: True
ChatGPT TTPs:
do not use without manual checkT1036, T1090, T1485, T1498, T1561, T1588.002, T1657
IOCs:
IP: 13
Soft:
Slack
Wallets:
bybit
Win API:
Hermit