Threat actor
threat_actor:lazarus_group
Also: APT38, Lazarus, Reconnaissance General Bureau, The Lazarus Group
North Korean-linked hacking group attributed in the episode to the Bangladesh Bank heist and other SWIFT attacks.
North Korean-linked hacking group attributed in the episode to the Bangladesh Bank heist and other SWIFT attacks.
“Security researchers dubbed this North Korean hacking group the Lazarus Group”
“Lazarus Group has been tied to almost all of the world’s SWIFT attacks to date.”
Name used by the security community for North Korean hackers associated in the episode with WannaCry and other campaigns.
“People in the security community call the North Korean hackers The Lazarus Group.”
Threat actor attributed by the FBI, US investigators, and other sources in the episode to North Korean cybercrime and cryptocurrency theft.
“this was the work of the Lazarus Group”
“Many crypto companies reported they received phishing attacks since 2018 onward that seemed to be coming from the Lazarus Group”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | SAME_AS | Reconnaissance General Bureau | Explicit | 72 |
| outgoing | ASSOCIATED_WITH | North Korea | Explicit | 72 |
| outgoing | ASSOCIATED_WITH | North Korea | Uncertain | 119 |
| outgoing | USES | SWIFT | Attributed | 72 |
| outgoing | TARGETS | Far Eastern International Bank | Explicit | 72 |
| outgoing | TARGETS | Bancomext | Explicit | 72 |
| outgoing | TARGETS | Bank of Chile | Explicit | 72 |
| outgoing | ASSOCIATED_WITH | Bureau 121 | Uncertain | 73 |
| outgoing | TARGETS | South Korea | Uncertain | 73 |
| outgoing | TARGETS | Japan | Uncertain | 73 |
| outgoing | TARGETS | United States | Uncertain | 73 |
| outgoing | USES | targeted phishing | Attributed | 119 |
| incoming | ATTRIBUTED_TO | Bangladesh Bank heist | Attributed | 72 |
| incoming | ATTRIBUTED_TO | Sony Pictures | Attributed | 73 |
| incoming | ATTRIBUTED_TO | Bangladesh Bank | Attributed | 73 |
| incoming | ATTRIBUTED_TO | WannaCry | Attributed | 73 |
| incoming | ATTRIBUTED_TO | NiceHash hack | Attributed | 119 |
| incoming | ATTRIBUTED_TO | WannaCry | Attributed | 119 |
| incoming | ASSOCIATED_WITH | Coincheck hack | Uncertain | 119 |
| incoming | ATTRIBUTED_TO | KuCoin hack | Attributed | 119 |
| incoming | ATTRIBUTED_TO | Ronin Bridge hack | Attributed | 119 |
| incoming | ATTRIBUTED_TO | Celas Trade Pro | Attributed | 119 |
| incoming | ATTRIBUTED_TO | Crypto Neuro Trader | Attributed | 119 |
| incoming | ASSOCIATED_WITH | Bobby Sierra | Uncertain | 119 |
Bangladesh Bank heist ATTRIBUTED_TO Lazarus Group
The episode says security researchers identified the hackers as the Lazarus Group, also known as APT38 and the Reconnaissance General Bureau.
Attributed Confidence 94% · Jack Rhysider EP 72 Details
“Security researchers dubbed this North Korean hacking group the Lazarus Group”
Lazarus Group SAME_AS Reconnaissance General Bureau
The episode presents Lazarus Group and the Reconnaissance General Bureau as the same named group.
Explicit Confidence 97% · Jack Rhysider EP 72 Details
“the Lazarus Group which also is known as the Reconnaissance General Bureau or APT38”
Lazarus Group ASSOCIATED_WITH North Korea
Lazarus Group is described as a North Korean hacking group; the episode links it to the North Korean government.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“this North Korean hacking group the Lazarus Group”
Lazarus Group USES SWIFT
Lazarus Group was described as being tied to nearly all of the world's SWIFT attacks covered in the episode.
Attributed Confidence 92% · Jack Rhysider EP 72 Details
“Lazarus Group has been tied to almost all of the world’s SWIFT attacks to date”
Lazarus Group TARGETS Far Eastern International Bank
The episode says Lazarus Group hit Taiwan's Far Eastern International Bank in October 2017.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“In October 2017, they hit the Taiwanese Far Eastern International Bank.”
Lazarus Group TARGETS Bancomext
The episode says Lazarus Group targeted Mexico's Bancomext between January and May 2018.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“Between January and May of 2018, they targeted Mexico’s Bancomext”
Lazarus Group TARGETS Bank of Chile
The episode says Lazarus Group targeted the Bank of Chile in May 2018.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“and in May 2018, it was the Bank of Chile”
Lazarus Group ASSOCIATED_WITH Bureau 121
The episode says security-community observers call the North Korean hackers the Lazarus Group and that those hackers are believed to work from Bureau 121.
Uncertain Confidence 90% · Jack Rhysider EP 73 Details
“Bureau 121 is where we believe North Korean hackers are working from. People in the security community call the North Korean hackers The Lazarus Group”
Lazarus Group TARGETS South Korea
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target South Korea.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea”
Lazarus Group TARGETS Japan
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target Japan.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan”
Lazarus Group TARGETS United States
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target the United States.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan, and the United States”
Sony Pictures ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute the Sony attack to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“the Lazarus Group is who carried out the attacks on Sony”
Bangladesh Bank ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute the Bangladesh Bank heist to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“did the Bangladesh Bank heist”
WannaCry ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute WannaCry to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“and conducted WannaCry”
NiceHash hack ATTRIBUTED_TO Lazarus Group
According to the FBI, the NiceHash theft was the work of the Lazarus Group.
Attributed Confidence 95% · Geoff White EP 119 Details
“according to the FBI, this was the work of the Lazarus Group”
Lazarus Group ASSOCIATED_WITH North Korea
The Lazarus Group is described as believed to be working on behalf of the North Korean government.
Uncertain Confidence 94% · Geoff White EP 119 Details
“believed to be working on behalf of the North Korean government”
WannaCry ATTRIBUTED_TO Lazarus Group
The WannaCry attack was attributed to the Lazarus Group, according to the episode's discussion.
Attributed Confidence 98% · Geoff White EP 119 Details
“the WannaCry attack was also attributed to the Lazarus Group”
Lazarus Group USES targeted phishing
The episode describes phishing emails attributed to Lazarus as carefully crafted for specific employees at specific companies.
Attributed Confidence 97% · Jack Rhysider EP 119 Details
“these phishing e-mails were often very well-crafted to target a specific person”
Coincheck hack ASSOCIATED_WITH Lazarus Group
The episode presents the possible North Korean/Lazarus attribution of Coincheck as unresolved and supported only by limited indicators.
Uncertain Confidence 98% · Geoff White EP 119 Details
“It is not clear to me and I don’t think it’s clear to investigators whether this was North Korean”
KuCoin hack ATTRIBUTED_TO Lazarus Group
The episode says the KuCoin attack was firmly attributed to North Korea and matched prior North Korean crypto-heists.
Attributed Confidence 95% · Jack Rhysider EP 119 Details
“This one is firmly attributed to being North Korea”
Ronin Bridge hack ATTRIBUTED_TO Lazarus Group
Security researchers attributed the Ronin attack to the Lazarus Group, according to the episode.
Attributed Confidence 95% · Jack Rhysider EP 119 Details
“many security researchers have attributed this attack to be the work of the Lazarus Group”
Celas Trade Pro ATTRIBUTED_TO Lazarus Group
Celas Trade Pro is described as a malicious cryptocurrency trading application allegedly launched by the Lazarus Group.
Attributed Confidence 93% · Geoff White EP 119 Details
“the hackers behind it who are allegedly the North Korean Lazarus Group”
Crypto Neuro Trader ATTRIBUTED_TO Lazarus Group
The recorded 2020 case involving Crypto Neuro Trader is attributed by US investigators to the Lazarus Group.
Attributed Confidence 94% · Geoff White EP 119 Details
“the Lazarus Group apparently got away with $11.8 million”
Bobby Sierra ASSOCIATED_WITH Lazarus Group
Jon Wu suspected Bobby Sierra might be a North Korean hacker; later, a US advisory reportedly matched the interview tactics, but the identity was not established as certain in the episode.
Uncertain Confidence 87% · Jon Wu EP 119 Details
“I think I just interviewed a North Korean hacker”