CVE Intelligence
Home / Threat actors / Lazarus Group

Lazarus Group G0032

🔔 Create alert

Also known as: Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
109
Techniques
26
Malware and tools

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.

Ransomware operations linked to this group ransomware.live

wannacry via WannaCry

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2018-4878 High · 7.8 KEV Ransomware Adobe Flash Player Use-After-Free Vulnerability
“Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.”

Techniques by tactic

Reconnaissance
T1589.002 Email AddressesT1591 Gather Victim Org Information
Resource Development
T1583.001 DomainsT1583.006 Web ServicesT1584.004 ServerT1585.001 Social Media AccountsT1585.002 Email AccountsT1587.001 MalwareT1588.002 ToolT1588.004 Digital Certificates
Initial Access
T1078 Valid AccountsT1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLLT1574.013 KernelCallbackTable
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1098 Account ManipulationT1542.003 BootkitT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Privilege Escalation
T1053.005 Scheduled TaskT1055.001 Dynamic-link Library InjectionT1078 Valid AccountsT1098 Account ManipulationT1134.002 Create Process with TokenT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Stealth
T1027.007 Dynamic API ResolutionT1027.009 Embedded PayloadsT1027.013 Encrypted/Encoded FileT1036.003 Rename Legitimate UtilitiesT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1055.001 Dynamic-link Library InjectionT1070 Indicator RemovalT1070.003 Clear Command HistoryT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1134.002 Create Process with TokenT1140 Deobfuscate/Decode Files or InformationT1202 Indirect Command ExecutionT1218 System Binary Proxy ExecutionT1218.005 MshtaT1218.011 Rundll32T1542.003 BootkitT1564.001 Hidden Files and DirectoriesT1574.001 DLLT1574.013 KernelCallbackTableT1620 Reflective Code Loading
Defense Impairment
T1553.002 Code SigningT1685 Disable or Modify ToolsT1686.003 Windows Host Firewall
Credential Access
T1056.001 KeyloggingT1110.003 Password SprayingT1557.001 Name Resolution Poisoning and SMB Relay
Discovery
T1010 Application Window DiscoveryT1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1124 System Time DiscoveryT1680 Local Storage Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSH
Collection
T1005 Data from Local SystemT1056.001 KeyloggingT1074.001 Local Data StagingT1557.001 Name Resolution Poisoning and SMB RelayT1560 Archive Collected DataT1560.002 Archive via LibraryT1560.003 Archive via Custom Method
Command and Control
T1001.003 Protocol or Service ImpersonationT1008 Fallback ChannelsT1071.001 Web ProtocolsT1090.001 Internal ProxyT1090.002 External ProxyT1102.002 Bidirectional CommunicationT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1571 Non-Standard PortT1573.001 Symmetric Cryptography
Exfiltration
T1041 Exfiltration Over C2 ChannelT1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Impact
T1485 Data DestructionT1489 Service StopT1491.001 Internal DefacementT1529 System Shutdown/RebootT1561.001 Disk Content WipeT1561.002 Disk Structure Wipe

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.