Threat Actor ProfileLazarus

2009-2012

2014

Lazarus made international headlines in 2014 with its attack on the film studio Sony Pictures Entertainment, prompted by the upcoming release of "The Interview," a comedy depicting an assassination attempt on North Korean leader Kim Jong-un. The attack began on November 24, when Sony employees were met by the image of a skull on every screen, accompanied by threats to release sensitive data unless the attackers’ demands were met. It is believed that Lazarus obtained a massive 100 terabytes of Sony data, the text equivalent of roughly 2.5 million books. Over the next few weeks, the group leaked a trove of unreleased films, executive salaries, and even Sony employees’ private medical records, causing immense embarrassment and financial losses for the company. This prompted several employees to initiate class action lawsuits against Sony for failing to protect their personal information. A senior Sony executive, whose own private emails had been exposed, was forced to step down in the aftermath. Lazarus also threatened physical violence against theaters screening "The Interview," forcing Sony to cancel its release.[10]

The Sony hack is remembered as one of the first cyberattacks where physical damage was caused to the victim, thanks to the Lazarus group’s use of wiper malware. This destructive malware, identified as WhiskeyAlfa, was designed to eradicate the contents of any hard drive connected to an infected system.[11] To maximize impact, Lazarus also deployed ransomware inside Sony’s network. Links were eventually made between the malware used against Sony and other malware associated with North Korea, prompting the FBI to attribute the attack to Lazarus. Sony's losses from the attack and the cancellation of "The Interview" release were estimated to exceed $100 million. Amidst international pressure, Sony eventually decided to release the film on Christmas Day, both in theaters and through video-on-demand platforms. Then-US President Barrack Obama praised this decision, asserting that the US should not capitulate to cyber threats or engage in self-censorship due to the fear of offending foreign powers.[12]

2016

Two years later, the Lazarus group once again captured global attention by orchestrating one of the most brazen bank heists in history. This time, their target was the central bank of Bangladesh, resulting in the theft of over $81 million. The attack began on February 4, 2016, when Lazarus hackers used malware known as SWIFT Client to access the bank’s SWIFT credentials, which could be used to communicate with other financial institutions and banks around the world. This enabled the hackers to send a series of transfer requests to the Federal Reserve Bank of New York, where Bangladesh Bank maintained a US-dollar account containing almost $1 billion. The fraudulent requests contained instructions to transfer all available funds to various accounts in the Philippines and Sri Lanka, which were disguised by using the names of fake charities and non-profit organizations. Because Lazarus had previously infiltrated Bangladesh Bank’s network using spear phishing, it appeared that the requests were made by a legitimate bank employee.[13]

Lazarus executed this attack with precision, choosing dates and times where communication between Bangladesh Bank and the Federal Reserve Bank of New York would be impeded. The first sign of suspicious activity was reported at Bangladesh Bank’s Dhaka office on Friday, February 5, when a printer used to document large international transfers stopped working. In Bangladesh, weekends take place on Friday and Saturdays, meaning that the bank was operating at reduced capacity. When employees noticed the broken printer, they chalked it up to a benign tech issue and didn’t attempt to reboot it until the following day. When the printer was eventually reinstated, it began to dispense the fraudulent transfer requests, alerting employees to the situation. They immediately tried to contact the Federal Reserve, but by then it was the weekend in the US. Unable to elicit a response, employees at Bangladesh Bank tried to block the transfers by contacting banks in the Philippines and Sri Lanka. However, this coincided with the Lunar New year holiday, meaning the banks were closed and the transfers could proceed. This strategy bought Lazarus five days to execute the attack with minimal interruption.[14]

Despite the technical sophistication and thorough planning demonstrated by the group, it was a simple spelling error that caused the house of cards to come tumbling down. Hackers misspelled “foundation” in the recipient NGO’s name as “fandation”, causing the routing bank to seek clarification from Bangladesh and allowing them to halt some of the transactions. At the same time, the unusually large number of payment instructions and the transfer requests to private entities was raising suspicions in New York. In total, the transactions that were stopped amounted to circa $870 million, leaving the hackers with just $81 million. Most of this money was never recovered, having been laundered through casinos in the Philippines.[15]

2017

On May 12, 2017, a ransomware variant known as WannaCry spread like wildfire around the world, infecting more than 300,000 devices in 150 countries. WannaCry spread like a worm, using self-propagation through a remote exploit made public two months earlier. The exploit took advantage of a flaw in the Microsoft Windows implementation of the Server Message Block (SMB) protocol, known as EternalBlue. This vulnerability was initially discovered by the US National Security Agency (NSA), who developed the EternalBlue exploit for its own intelligence gathering purposes. This exploit was revealed to the public in early 2017 by the hacking group Shadow Brokers, who compromised the NSA and leaked a cache of exploits online. Just two months later it would be used to orchestrate one of the broadest and most damaging ransomware attacks in history.[16]

Several high-profile organizations were impacted by the spread of WannaCry, including the Spanish mobile company Telefónica, auto manufacturer Renault-Nissan, Russia’s Interior Ministry, and the UK’s National Health Service. In the case of the latter, hospitals, doctor’s surgeries, and ambulance services were disrupted for several days, endangering the lives of patients, and costing the UK’s national health service an estimated GBP 92 million.[17] It is likely that the impact would have been far worse if not for a serendipitous discovery by the British security researcher Marcus Hutchins, however. Hutchins, previously MalwareTech, discovered an unusual function when reversing the WannaCry malware. He noticed that before the malware was executed, it would query the domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, which did not exist. He proceeded to register the domain, unintentionally triggering a “kill switch” which prevented WannaCry from executing on newly infected computers. This saved countless organizations around the world from having their files encrypted. Nonetheless, the worldwide disruption caused by WannaCry produced an estimated $8 billion in damages.[18] In the days following the attack, researchers at Symantec and Kaspersky identified links between WannaCry and Lazarus, noting code overlaps between WannaCry and previously identified Lazarus tools. In the months that followed, countries including the US, UK, and Canada attributed the attack to Lazarus.[19] For more technical details about WannaCry, check out Chapter 2 of our Definitive Guide to Ransomware.  

2019-2023

Beginning in 2019, Lazarus launched a broad cyber-espionage campaign targeting companies in the aerospace and defense sectors, mostly located in Europe, the United States, and the Middle East. The group relied heavily on social engineering to pull off this campaign, leveraging LinkedIn and other messaging platforms to establish initial contact with their targets, who held technical and business-related job titles. The attackers created fake profiles to impersonate hiring managers from prominent US firms. The targets were then lured into opening and interacting with malicious documents, which triggered the execution of custom, multistage malware. This malware was designed to infiltrate the target’s systems and exfiltrate valuable information without detection. In 2023, Lazarus introduced Linux malware into the campaign, demonstrating an evolution in their tactics.[20] [21] To read more about Operation Dream Job, check out our blog: Cyber Siege on the Fourth Estate. 

2022

As previously mentioned, the Lazarus group has intensified its targeting of the cryptocurrency industry in recent years. In 2022, the group managed to steal a whopping $600 million worth of Ethereum and $25.5 million of USDC stablecoin from Ronin Network, an EVM (Ethereum Virtual Machine)-compatible blockchain made for gaming. This marked one of the largest attacks on a decentralized finance system to date. Ronin Network is tied to Axie Infinity, a popular blockchain game developed by Vietnamese studio Sky Mavis. The attack involved Lazarus compromising Sky Mavis’s Ronin validator nodes and Axie DAO validator nodes, allowing the funds to be siphoned away in just two transactions. According to Sky Mavis, private keys obtained by Lazarus were used to forge fake withdrawals. At the time, five validator nodes were required for any deposit or withdrawal from the Ronin chain. In light of the attack, this number has since been increased to eight.[22] 

North Korea is the global leader in cryptocurrency attacks. In 2022 alone, an estimated $1.7 billion was stolen by North Korean hackers, $1 billion of which was stolen from decentralized finance (DeFi) protocols. These stolen funds make up a significant chunk of the nation’s economy and are likely used to fund the country’s nuclear weapons programme. In recent years, several cryptocurrency mixers have been sanctioned by the US government for helping Lazarus and other North Korean groups to launder stolen funds. More information about this can be found in the Trends section.[23]