Lazarus Group
No sourced public emblem in this profile.
research profile · reported nexus: KP (not nationality)
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.
Source-reported aliases: Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Subgroup: Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Operation AppleJeus, APT38, APT 38, Stardust Chollima, Whois Hacking Team, Zinc, Appleworm, Nickel Academy, APT-C-26, NICKEL GLADSTONE, COVELLITE, ATK3, G0032, ATK117, G0082, Citrine Sleet, DEV-0139, DEV-1222, Diamond Sleet, ZINC, Sapphire Sleet, COPERNICIUM, TA404, Lazarus group, BeagleBoyz, Moonstone Sleet. Associations do not prove equivalence.
Kinwilder analysis
Treat Lazarus as a scope problem before treating it as a single organization chart. Sources use overlapping names at different resolutions. Preserve the original report's label, date and confidence; link related clusters without merging every incident or operator. For defenders, identity controls, software supply-chain review and separate verification of privileged actions remain useful even when an attribution remains disputed.
Target geography
Catalog-listed countries (associations, not attack counts): 
South Korea · 
United States of America · 
Thailand · 
France · 
China · 
Hong Kong · 
United Kingdom · 
Guatemala · 
Canada · 
Bangladesh · 
Japan · 
India · 
Germany · 
Brazil · 
Australia
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
2026-10-27: One transaction, several meanings. Where can transaction intent change between a signer, a wallet service and the chain?
References
https://attack.mitre.org/groups/G0032/
https://www.us-cert.gov/ncas/alerts/TA17-164A
https://www.us-cert.gov/ncas/alerts/TA17-318A
https://www.us-cert.gov/ncas/alerts/TA17-318B
https://securelist.com/operation-applejeus/87553/
https://securelist.com/lazarus-under-the-hood/77908/
https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf
https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/
https://www.cfr.org/interactive/cyber-operations/lazarus-group
https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret
https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea
https://content.fireeye.com/apt/rpt-apt38
https://www.theguardian.com/world/2009/jul/08/south-korea-cyber-attack