Lazarus Group
North Korean state-sponsored (RGB) · Financial theft / espionage / sanctions evasion
Tactics, Techniques & Procedures (TTPs)
- TraderTraitor LinkedIn fake job offer social engineering
- Trojanised developer tools, npm packages, and GitHub repositories
- Cryptocurrency exchange hot wallet targeting
- SWIFT financial messaging system compromise
- AppleJeus macOS malware for crypto platforms
- Supply chain software poisoning
- TraderTraitor: LinkedIn and Telegram fake job offer social engineering targeting developers at crypto exchanges
- Trojanised developer tools, malicious npm and PyPI packages for supply chain compromise
- Safe{Wallet} developer device compromise to inject malicious JavaScript into multisig wallet interface (Bybit, Feb 2025)
- AppleJeus macOS malware family for cryptocurrency platform targeting
- GitHub repository social engineering and fake open-source project contributions
- SWIFT financial messaging system compromise (APT38 historical, BankBotABE/DYEPACK malware)
Known Targets
Analyst Notes
Operates under North Korea's Reconnaissance General Bureau (RGB). Estimated $3B+ stolen in cryptocurrency since 2017, used to fund DPRK weapons programmes. WannaCry 2017 attributed to Lazarus. The Bybit exchange theft in February 2025 — $1.5 billion — is the largest single cryptocurrency theft on record, executed via a compromised Safe{Wallet} developer. Additional reporting: This tracking cluster combines overlapping Lazarus sub-designations: APT38 (financial crime wing focused on SWIFT and banking); UNC4736/TraderTraitor (developer supply chain and cryptocurrency theft). The February 2025 Bybit theft — $1.5 billion, the largest single cryptocurrency theft on record — was executed via compromise of a Safe{Wallet} developer machine, injecting malicious JavaScript into the multisig wallet interface that transparently substituted attacker-controlled addresses during signing. The attack required no access to Bybit systems directly. Estimated $3B+ stolen in cryptocurrency since 2017; proceeds fund North Korean weapons programmes. See also: Lazarus Group (parent cluster profile).
Also Known As
MITRE ATT&CK Techniques
Intelligence Reports
Lazarus Burned a Windows Kernel Zero-Day for Six Weeks Targeting Defence and Aerospace
CVE-2026-68820, a use-after-free in Windows AFD.sys patched on August 11 Patch Tuesday, was actively exploited by North Korea's Lazarus Group since early July in a fresh Operation Dream Job wave targeting defence, aerospace, aviation, and UAV firms across Europe and India. The attack chain drops the FudModule rootkit and a newly identified modular backdoor named Troy.
Lazarus Group / TraderTraitor: North Korea's Premier Financial Theft Operation
A comprehensive profile of Lazarus Group and its TraderTraitor subcluster -- the North Korean cyber apparatus responsible for over $6 billion in cryptocurrency theft, the largest single financial heist in history, and a growing campaign of developer-targeted supply chain intrusions.
Lazarus Group Extends Cryptocurrency Targeting to UK Exchanges and Law Firm Custodians
North Korea's Lazarus Group has extended its cryptocurrency theft operations to UK-regulated digital asset exchanges and the law firms that provide custody and compliance services to crypto clients -- combining financial theft with intelligence collection.