The Demon Lazarus, Who Rises for Money

Legend

A North Korean state-sponsored group, active since at least 2009, combining espionage, destruction and large-scale financial theft. It is blamed for the Sony Pictures hack, the $81 million Bangladesh Bank heist, WannaCry and billions in cryptocurrency thefts.

Exorcism

Cast it out by distrusting too-good job offers and files sent by "recruiters", its favourite bait. For crypto, use cold wallets, multi-party approval for transfers and checks on what is being signed.

Technical record

Also known as: HIDDEN COBRA, Guardians of Peace, ZINC, Diamond Sleet, Labyrinth Chollima
Circle: Circle V · State espionage · Circle III · Ransomware and extortion · Circle VI · Banking trojans and infostealers · Circle IV · Destroyers (wipers)
First seen: c. 2009
Status: Active
Weapons (exploited CVEs): Saint EternalBlue, Escaped From the Arsenal · Saint Log4Shell, Martyr of JNDI

A North Korean state-sponsored group active since at least 2009 that combines espionage, destruction and large-scale financial theft. It is blamed for the Sony Pictures hack, the $81 million Bangladesh Bank heist, WannaCry and billions in cryptocurrency theft. The US has charged several North Korean operatives in connection with its activity.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference G0032