Lazarus Group Case Study: North Korean Hacker Group

[ExcalibuR]

Lazarus Group is one of the most dangerous state hacker groups associated with the DPRK. Active since 2009, it specializes in cyber espionage, financial attacks and infrastructure destabilization.

Who is behind Lazarus Group?​

Origin and connections​

• Affiliation: Confirmed connection with North Korean intelligence (General Staff Intelligence Directorate, Bureau 121).
• Funding: Part of the proceeds goes to the DPRK's nuclear program (according to the UN).
• Known subgroups:
  • Hidden Cobra (attacks on the US)
  • BlueNoroff (financial theft)
  • Andariel (targeted attacks on South Korea)

Lazarus Group's Main Attacks​

1. Financial theft (Banking Malware)​

• 2016: Bangladesh Bank Heist ($81 million via SWIFT hack)
• 2019: Attacks on crypto exchanges (CoinCheck, Upbit — losses $500+ million)
• 2022: Harmony Bridge Hack ($100 million in crypto)

Methods:

• Phishing with fake vacancies in IT companies.
• Introduction of Trojans (Backdoor.Duuzer, AppleJeus).

2. Cyber espionage (APT attacks)​

• 2014: Sony Pictures Hack (revenge for the film "The Interview")
• 2017: WannaCry (ransomware that paralyzed hospitals and businesses)
• 2020: Attacks on Vaccine Labs (COVID-19)

Tools:

• Home-made exploits (e.g. OpenSource based RATs ).
• 0-day vulnerabilities (for example, in Samsung software).

3. Attacks on cryptocurrencies​

• Hacks of DeFi protocols and bridges (Ronin Network - $625 million).
• Using mixers (Tornado Cash) for money laundering.

How did they catch them?​

1. OpSec Errors​

• Using the same C&C servers (eg IP from North Korea).
• Traces in the code:
  • Korean comments in scripts.
  • Using North Korean software (for example, RedStar OS).

2. Coordination of special services​

• FBI, CIA, South Korea have planted agents in the group.
• Chainalysis tracked transactions on the blockchain.

3. Sanctions against the DPRK​

• Freezing Lazarus crypto wallets (eg Tornado Cash).
• Hosting blocking (Alibaba Cloud stopped servicing North Korean IPs).

Results and consequences​

• Damage: $2+ billion over 10 years.
• Countermeasures:
  • Strengthening SWIFT security.
  • Regulators require KYC for DeFi .
  • Banks are implementing AI to detect anomalies.

What did this case teach us?​

1. State hacking is a real threat (DPRK, Russia, China).
2. Cryptocurrencies are the main goal (anonymity + fast transfers).
3. We cannot do without international cooperation (FBI + Interpol + private companies).

Want another case study? For example, Fancy Bear (Russian hackers)?