Lazarus Group is the umbrella designation for cyber units operated by North Korea's Reconnaissance General Bureau (RGB) — the country's primary intelligence service. It is one of the few state-sponsored actors that routinely pursues direct financial gain, both to fund the DPRK regime under sanctions and to finance its weapons programs.
Across roughly two decades, Lazarus has demonstrated an unusually broad operational portfolio: destructive wipers (Sony Pictures, 2014), bank-network theft via SWIFT (Bangladesh Bank, 2016), global ransomware (WannaCry, 2017), and — since 2018 — an aggressive focus on cryptocurrency theft. UN expert reports estimate North Korean crypto theft proceeds between 2017 and 2023 at over $3 billion.
Operating method
The current Lazarus playbook against crypto entities is unusually consistent:
- Reconnaissance via LinkedIn / GitHub to identify engineers at exchanges, custody providers, and DeFi protocols.
- Fake job offers — typically remote roles with attractive salaries — to lure engineers into video interviews and "coding challenges."
- Malicious dependencies or interview tooling delivered during the assessment phase, dropping custom backdoors (AppleJeus, recently the FudModule rootkit) on engineering laptops.
- Privileged access escalation to signing keys, wallet infrastructure, or smart-contract upgrade keys.
- Theft and laundering via Tornado Cash (sanctioned by OFAC in 2022 specifically because of Lazarus use), cross-chain bridges, and OTC desks.
Why it matters
Lazarus is the canonical example of state-sponsored actors operating for financial gain at scale. Its persistence, technical sophistication, and willingness to absorb attribution costs make it nearly unique among APTs. Defensive guidance from CISA, FBI, and Treasury (alert AA22-108A and successors) is the most operationally specific public material available on a state actor.