Lazarus Group

THREAT ACTOR PROFILE

Lazarus Group

Lazarus Group is a North Korean state-sponsored operation behind espionage, sabotage and large-scale financial theft, from the 2014 Sony Pictures hack to WannaCry in 2017. In 2026 its activity centers on software developers, defense and aerospace firms and fake IT workers hired into Western companies.

North Korea

Government / Private Sector

First seen

2014

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Why 45 aliases point to one Lazarus record

Our record for Lazarus carries 45 synonyms, more than any other actor we track. Part of that is vendor naming, and part is that "Lazarus" has long covered several DPRK teams at once, including Andariel and Bluenoroff (APT38).

That matters when you hunt. A report on TA444, Sapphire Sleet or UNC2970 may describe a subgroup with its own tooling, so check which cluster a vendor means before reusing its IOCs. We keep all of these mapped in our threat actor profiles, with the most common ones below.

GROUP PROFILE

Espionage, sabotage and theft under one DPRK name

Lazarus mixes state intelligence work with operations that raise money for the regime. Our records list Bangladesh Bank and Sony Pictures Entertainment among its past victims, alongside targets in South Korea, the US, Japan, India and Europe.

Kudelski Security's research on DPRK cyber capabilities breaks the old Lazarus umbrella into separate clusters under the GRIB (formerly RGB). It also documents shared VPN exit nodes between fake IT workers and offensive teams, which is a useful pivot for defenders.

The 2026 reporting we track points the same way. Developers with access to code, keys and crypto wallets are the main target, followed by defense and aerospace companies approached through fake job offers.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Fake recruiters, poisoned repos and a kernel zero-day

The stages below come from 2026 Lazarus activity documented in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

MISTPEN, FudModule and blockchain-resolved C2

Initial Access

CVES EXPLOITED

A Windows zero-day and a Roundcube webmail bug

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

Lazarus Group

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Lazarus Group

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Lazarus Group

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Developers and defense firms took most 2026 hits

Three recent reports show Lazarus going after the people who build software and hire contractors, with fewer phishing emails and more fake jobs.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.