Lazarus Group

{
  "id": "ATTACK:ics:G0032",
  "title": "Lazarus Group",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0032",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
  "external_id": "G0032",
  "domain": "ics",
  "created": "2017-05-31T21:32:03.807Z",
  "modified": "2026-07-31T20:48:46.106Z",
  "version": "5.0",
  "aliases": [
    "Lazarus Group",
    "Labyrinth Chollima",
    "HIDDEN COBRA",
    "Guardians of Peace",
    "ZINC",
    "NICKEL ACADEMY",
    "Diamond Sleet"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Labyrinth Chollima"
    },
    {
      "source_name": "Diamond Sleet"
    },
    {
      "source_name": "ZINC"
    },
    {
      "source_name": "Lazarus Group"
    },
    {
      "source_name": "NICKEL ACADEMY"
    },
    {
      "source_name": "Guardians of Peace"
    },
    {
      "source_name": "CrowdStrike Labyrinth Chollima Feb 2022",
      "url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
    },
    {
      "source_name": "Mandiant DPRK Groups 2023",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
    },
    {
      "source_name": "Mandiant DPRK Laz Org Breakdown 2022",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Novetta Blockbuster",
      "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
    },
    {
      "source_name": "Secureworks NICKEL ACADEMY Dec 2017",
      "url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
    },
    {
      "source_name": "Microsoft ZINC disruption Dec 2017",
      "url": "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"
    },
    {
      "source_name": "HIDDEN COBRA"
    },
    {
      "source_name": "Treasury North Korean Cyber Groups September 2019",
      "url": "https://home.treasury.gov/news/press-releases/sm774"
    },
    {
      "source_name": "US-CERT HIDDEN COBRA June 2017",
      "url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
    },
    {
      "source_name": "US-CERT HOPLIGHT Apr 2019",
      "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
    },
    {
      "source_name": "JPCert Blog Laz Subgroups 2025",
      "url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
    }
  ]
}