Lazarus Group

Background

Lazarus Group is the name given by cybersecurity researchers to a cluster of hacking activity assessed by U.S. and allied government agencies, as well as private security firms, to be run by North Korea. The group is believed to have been active since at least 2009, with an early documented operation being the so-called "Operation Troy" campaign of 2009-2012, which used distributed denial-of-service (DDoS) attacks against South Korean and U.S. government and media websites. Researchers have also used related names for parts of the group's activity, including Hidden Cobra, APT38, Zinc, and BlueNoroff, the last of which is generally associated with the group's financially motivated operations. The U.S. Department of Justice and the Cybersecurity and Infrastructure Security Agency have tied the group's personnel to North Korea's Reconnaissance General Bureau, the country's primary military intelligence agency.

The Sony Pictures Hack

In November 2014, a group calling itself "Guardians of Peace" breached the network of Sony Pictures Entertainment, destroying data on company computers and leaking unreleased films, internal emails, and employee personal information. The attack was linked to anger over the studio's planned release of "The Interview," a comedy depicting the assassination of North Korean leader Kim Jong-un. In December 2014, the FBI publicly attributed the intrusion to the North Korean government, marking one of the first instances of a formal U.S. government cyberattack attribution against a nation-state. Security researchers subsequently connected malware and infrastructure used in the Sony breach to the wider Lazarus Group cluster.

The Bangladesh Bank Heist

In February 2016, hackers linked to Lazarus Group targeted Bangladesh Bank, the central bank of Bangladesh, attempting to steal nearly $1 billion by issuing fraudulent transfer instructions through the SWIFT interbank messaging network. Most of the attempted transfers were blocked, but roughly $101 million was successfully diverted, including $81 million routed to accounts in the Philippines and about $20 million to Sri Lanka. A misspelling in one transfer request ("fandation" instead of "foundation") triggered a compliance check that halted the Sri Lanka transfer. Security firms including Symantec and BAE Systems linked malware and tools used in the heist to Lazarus Group, and the operation is considered one of the largest attempted bank robberies in history.

WannaCry

In May 2017, the WannaCry ransomware worm spread rapidly across the world, encrypting files on infected Windows computers and demanding Bitcoin ransom payments. It exploited a Windows Server Message Block vulnerability using the EternalBlue exploit, a tool believed to have been developed by the U.S. National Security Agency and leaked earlier that year by a group known as the Shadow Brokers. WannaCry affected an estimated 200,000-300,000 computers across roughly 150 countries within days, notably disrupting Britain's National Health Service, where thousands of appointments and operations were cancelled. Security researcher Marcus Hutchins slowed the outbreak by registering a domain that acted as an inadvertent kill switch built into the malware. In December 2017, the United States and United Kingdom formally attributed WannaCry to North Korea, and security researchers at Kaspersky Lab and Symantec had earlier identified code overlaps with known Lazarus Group tools.

Legal Action and Sanctions

In September 2018, the U.S. Department of Justice unsealed criminal charges against Park Jin Hyok, described as a North Korean government hacker, for his alleged role in the Sony Pictures hack, the WannaCry attack, and the Bangladesh Bank theft. In February 2021, the Justice Department expanded the case with an indictment naming Park alongside two other alleged North Korean military intelligence hackers, Jon Chang Hyok and Kim Il, describing a wide-ranging scheme that also included attacks on cryptocurrency exchanges and the development of a malicious cryptocurrency application called Marine Chain. In April 2022, the U.S. Treasury's Office of Foreign Assets Control placed Lazarus Group and related entities under sanctions tied to North Korea's weapons and cyber programs.

Legacy

Lazarus Group is widely cited by governments and cybersecurity researchers as a defining example of state-sponsored cybercrime that blends traditional espionage tradecraft with financially motivated theft, including later, extensive targeting of cryptocurrency exchanges and decentralized finance platforms. Its documented activity spanning destructive attacks, global ransomware, and multimillion-dollar financial fraud has made it a recurring subject of threat intelligence reporting, sanctions actions, and academic study of nation-state cyber operations.

Timeline

• 2009Earliest documented activity attributed to the group, including DDoS campaigns later referred to as Operation Troy, targeting South Korean and U.S. websites.
• 2014-11Sony Pictures Entertainment is breached by attackers calling themselves Guardians of Peace, leaking films, emails, and employee data.
• 2014-12The FBI publicly attributes the Sony Pictures hack to the North Korean government.
• 2016-02Hackers attempt to steal nearly $1 billion from Bangladesh Bank via fraudulent SWIFT transfers; roughly $101 million is successfully diverted.
• 2017-05-12The WannaCry ransomware worm begins spreading globally, exploiting the EternalBlue SMB vulnerability and disrupting the UK's National Health Service among hundreds of thousands of systems.
• 2017-12The United States and United Kingdom formally attribute the WannaCry attack to North Korea.
• 2018-09The U.S. Department of Justice unseals criminal charges against North Korean programmer Park Jin Hyok for the Sony, WannaCry, and Bangladesh Bank attacks.
• 2021-02The DOJ announces an expanded indictment against three North Korean military intelligence operatives for a broad scheme including bank and cryptocurrency theft.
• 2022-04The U.S. Treasury's OFAC sanctions Lazarus Group entities tied to North Korea's cyber and weapons programs.