Security Resilience

Threat actor · all actors

Lazarus GroupG0032 state

🇰🇵 KP · RGB · Bureau 121 / Lab 110

aka Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet, Operation DarkSeoul, Dark Seoul, Hastati Group, Andariel, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Subgroup: Bluenoroff, Group 77, Operation Troy, Operation GhostSecret, Operation AppleJeus, APT38, APT 38, Stardust Chollima, Whois Hacking Team, Appleworm, APT-C-26, NICKEL GLADSTONE, COVELLITE, ATK3, G0032, ATK117, G0082, Citrine Sleet, DEV-0139, DEV-1222, Sapphire Sleet, COPERNICIUM, TA404, BeagleBoyz, Moonstone Sleet, Black Artemis, Silent Chollima, OperationTroy, Guardian of Peace, GOP, WHOis Team, Subgroup: Andariel, Onyx Sleet, PLUTONIUM

Last updated: 2026-10-16

45attributed CVEs
128ATT&CK techniques
122.7IDF score (tooling uniqueness)
1exclusive CVEs
2017–2025years active

About this actor

[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0032G0082

Microsoftweather-system names

Diamond SleetCitrine SleetSapphire SleetMoonstone SleetOnyx Sleet

CrowdStrikenation-animal names

Labyrinth ChollimaHIDDEN COBRAStardust ChollimaSilent Chollima

Mandiant / genericAPT numbering

APT38APT 38

Secureworkscolour-metal names

NICKEL ACADEMYNICKEL GLADSTONE

DragosICS mineral names

COVELLITE

ProofpointTA threat-actor id

TA404

Unclassifiedno scheme matched

Lazarus GroupGuardians of PeaceZINCOperation DarkSeoulDark SeoulHastati GroupAndarielUnit 121Bureau 121NewRomanic Cyber Army TeamBluenoroffSubgroup: BluenoroffGroup 77Operation TroyOperation GhostSecretOperation AppleJeusWhois Hacking TeamApplewormAPT-C-26ATK3ATK117DEV-0139DEV-1222COPERNICIUMBeagleBoyzBlack ArtemisOperationTroyGuardian of PeaceGOPWHOis TeamSubgroup: AndarielPLUTONIUM

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 128 ATT&CK techniques on file.
Named victims
2 extracted from reporting.

See how actor data is built for the full pipeline.

Activity timeline

2017: 1 CVE published120172018: 1 CVE published120182019: 3 CVE published320192021: 8 CVE published2021: 4 KEV added1220212022: 14 CVE published2022: 9 KEV added2320222023: 18 CVE published2023: 15 KEV added3320232025: 1 KEV added12025
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2022-22947 KEV10.010.00.98252022-03-03see CVE
CVE-2023-46604 KEV10.010.00.99892023-10-27see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2021-20028 KEV9.99.80.85852021-08-04see CVE
CVE-2021-20038 KEV9.99.80.99912021-12-08see CVE
CVE-2021-3018 9.99.80.79332021-01-05see CVE
CVE-2021-41773 KEV9.99.80.99992021-10-05see CVE
CVE-2021-45837 9.99.80.81082022-04-25see CVE
CVE-2022-22965 KEV9.99.80.99722022-04-01see CVE
CVE-2022-41352 KEV9.99.80.97012022-09-26see CVE
CVE-2022-47966 KEV9.99.80.99752023-01-18see CVE
CVE-2023-25690 9.99.80.84512023-03-07see CVE
CVE-2023-27997 KEV9.99.80.92422023-06-13see CVE
CVE-2023-28771 KEV9.99.80.99282023-04-25see CVE
CVE-2023-33010 KEV9.99.80.29022023-05-24see CVE
CVE-2023-33246 KEV9.99.80.97362023-05-24see CVE
CVE-2023-34362 KEV9.99.80.99932023-06-02see CVE
CVE-2023-35078 KEV9.99.81.00002023-07-25see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2023-42793 KEV9.99.80.99992023-09-19see CVE
CVE-2022-25064 9.79.80.63102022-02-25see CVE
CVE-2023-2868 KEV9.79.40.91452023-05-24see CVE
CVE-2023-3079 KEV9.28.80.37862023-06-05see CVE
CVE-2023-32315 KEV9.28.61.00002023-05-26see CVE
CVE-2021-44142 9.18.80.74042022-02-21see CVE
CVE-2021-36955 KEV8.57.80.26462021-09-15see CVE
CVE-2021-43226 KEV8.57.80.12292021-12-15see CVE
CVE-2022-24990 KEV8.57.50.96752023-02-07see CVE
CVE-2022-30190 KEV8.57.80.99372022-06-01see CVE
CVE-2023-32784 8.47.50.76482023-05-15see CVE
CVE-2022-27925 KEV8.17.20.98682022-04-21see CVE
CVE-2023-0669 KEV8.17.21.00002023-02-06see CVE
CVE-2022-21882 KEV7.97.00.90452022-01-11see CVE
CVE-2022-22005 7.78.80.17212022-02-09see CVE
CVE-2019-15637 7.48.10.22732019-08-26see CVE
CVE-2022-24665 7.49.90.02622022-02-16see CVE
CVE-2022-24663 7.39.90.02102022-02-16see CVE
CVE-2022-24664 7.39.90.01662022-02-16see CVE
CVE-2021-40684 7.19.10.01252021-09-22see CVE
CVE-2023-21932 7.17.20.44962023-04-18see CVE
CVE-2022-24785 6.97.50.13902022-04-04see CVE
CVE-2015-6585 6.47.80.03962017-07-25see CVE
CVE-2017-4946 5.97.80.00532018-01-05see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-477 / 12860%
CM-267 / 12852%
CM-665 / 12851%
SI-365 / 12851%
CA-750 / 12839%
AC-649 / 12838%
AC-348 / 12838%
CM-744 / 12834%
SC-741 / 12832%
AC-239 / 12830%
AC-437 / 12829%
SI-735 / 12827%
AC-528 / 12822%
IA-226 / 12820%
CM-525 / 12820%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category