Lazarus Group
IntrusionSet · ATTACK:enterprise:G0032
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0032",
"title": "Lazarus Group",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0032",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
"external_id": "G0032",
"domain": "enterprise",
"created": "2017-05-31T21:32:03.807Z",
"modified": "2026-07-31T20:48:46.106Z",
"version": "5.0",
"aliases": [
"Lazarus Group",
"Labyrinth Chollima",
"HIDDEN COBRA",
"Guardians of Peace",
"ZINC",
"NICKEL ACADEMY",
"Diamond Sleet"
],
"tactics": [
],
"source_references": [
{
"source_name": "Labyrinth Chollima"
},
{
"source_name": "Diamond Sleet"
},
{
"source_name": "ZINC"
},
{
"source_name": "Lazarus Group"
},
{
"source_name": "NICKEL ACADEMY"
},
{
"source_name": "Guardians of Peace"
},
{
"source_name": "CrowdStrike Labyrinth Chollima Feb 2022",
"url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
},
{
"source_name": "Mandiant DPRK Groups 2023",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
},
{
"source_name": "Mandiant DPRK Laz Org Breakdown 2022",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Novetta Blockbuster",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
},
{
"source_name": "Secureworks NICKEL ACADEMY Dec 2017",
"url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
},
{
"source_name": "Microsoft ZINC disruption Dec 2017",
"url": "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"
},
{
"source_name": "HIDDEN COBRA"
},
{
"source_name": "Treasury North Korean Cyber Groups September 2019",
"url": "https://home.treasury.gov/news/press-releases/sm774"
},
{
"source_name": "US-CERT HIDDEN COBRA June 2017",
"url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
},
{
"source_name": "US-CERT HOPLIGHT Apr 2019",
"url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
},
{
"source_name": "JPCert Blog Laz Subgroups 2025",
"url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
}
]
}Explicit source assertions (120)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0364
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00e9a38d-6dc5-4d67-b2fe-977b1c7d17dd
Novetta Blockbuster Destructive Malware · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--032981a6-3299-4852-bd9c-c691f866bec5
Novetta Blockbuster Destructive Malware · Novetta Blockbuster · Qualys LolZarus · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecret · US-CERT SHARPKNOT June 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--061841f1-5814-41e3-94b5-536b8a52d062
Qualys LolZarus · Lazarus APT January 2022 · McAfee Bankshot · Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1202
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09710ce1-9ed9-4c25-a86f-0a481174cc0d
Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0238
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09c957e3-f89b-4b41-93af-bde08f00ce36
McAfee GhostSecretATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a8ee649-e907-4a73-8513-3019b2d771a0
Novetta Blockbuster RATs · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1001.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b255cef-7177-48b8-ade1-752314f90b7e
Novetta Blockbuster Destructive Malware · Novetta Blockbuster · McAfee-GhostSecret-fixurl · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dcce53a-3ac1-4528-8c34-f85569638740
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--115562b8-9d7c-435e-af6e-0be6249742d0
ESET Twitter Ida Pro Nov 2021 · TrendMicro macOS Dacls May 2020 · Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster · Qualys LolZarus · Lazarus APT January 2022 · SentinelOne Lazarus macOS July 2020 · Kaspersky ThreatNeedle Feb 2021 · Google TAG Lazarus Jan 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c617b6-9c95-46fd-a3ef-845be82ac237
Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--170e2f76-5b6a-4eee-8ea4-d1171368b4a9
Novetta Blockbuster Loaders · Novetta Blockbuster Tools · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1754cf51-f712-4e7c-9108-fa276b9f1543
CISA AppleJeus Feb 2021 · Google TAG Lazarus Jan 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a40426a-355c-4d7e-b51c-e95a102b31e2
Novetta Blockbuster Tools · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0245
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c12b31e-7f17-4e00-a6b5-7eddb5828f34
US-CERT BADCALLATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cf34ba1-c2e4-4277-86fc-b511ae416a0e
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0181
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--216c15b0-3091-49f2-ba85-356d56265671
US-CERT FALLCHILL Nov 2017ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2325c0b2-fb89-44e1-9206-e495811f2907
Novetta Blockbuster Destructive Malware · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2426519f-c915-4c8f-8164-0d93dbbf0be1
McAfee Lazarus Resurfaces Feb 2018 · SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020 · Lazarus APT January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0366
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e7ca82-2784-433a-90a9-a3483615a655
FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · FireEye APT38 Oct 2018 · LogRhythm WannaCryATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27323a25-ef80-4519-b934-19f5ff090c70
Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b9855a9-f381-4a3e-a0c2-80310374b165
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c131932-4632-4866-845f-212cbe29756d
McAfee Lazarus Jul 2020 · Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c9c331c-0e39-43ad-95e4-38957ad7b956
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--324d5c17-a282-4a61-8fad-50ab914f425c
Microsoft DiamondSleet 2023ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S1182
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34bba6a3-6e01-4895-8eb6-df0ba2fab222
Cisco MagicRAT 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0376
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35305a51-69ac-4fe2-b9e2-3c9a296e9f9b
US-CERT HOPLIGHT Apr 2019ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0263
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3933f2fa-9154-4ab4-b9cc-975a1dfbecf5
US-CERT TYPEFRAME June 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d
Novetta Blockbuster Loaders · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39fdd17c-5f59-4daf-bf14-95841b5ec248
US-CERT FALLCHILL Nov 2017 · TrendMicro macOS Dacls May 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3afd226c-934f-44fd-8194-9a6dee5cba59
TrendMicro macOS Dacls May 2020 · Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · Qualys LolZarus · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0567
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b24afd4-b13b-4c73-bb20-aeff4a44574c
Kaspersky DtrackATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cf183ef-05aa-47ad-b691-654c0648326a
Lazarus APT January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3faf013a-e1c4-494a-b2a1-6e9abef908b9
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fe9b64a-6435-4592-9181-2ad50ee93044
Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--411aae3a-f612-41bb-b2f0-1639d2cbc290
Novetta Blockbuster Destructive MalwareATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4189f5b4-4c57-452a-a3fb-da5988804feb
Novetta Blockbuster Loaders · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41c193c1-8269-4a2e-9ed8-9dd51489a03f
CISA AppleJeus Feb 2021ATTACK:enterprise:C0022 → attributed-to → ATTACK:enterprise:G0032
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b66e057-adbc-498d-99ee-156e0d17bd53
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c06e313-2cde-494c-a8dc-449649a1afa6
Novetta Blockbuster Destructive Malware · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecretATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa
Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecretATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c
Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018 · SentinelOne Lazarus macOS July 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--510616c2-f124-49b2-83a2-cac81d2d4155
Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--520f5440-740f-4efe-850e-ea4db340aef1
Novetta Blockbuster Loaders · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53a66a44-0620-4edc-bb9d-c40cfcb17546
Lazarus APT January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320
Novetta Blockbuster Loaders · Novetta Blockbuster RATs · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a0ce8c4-e941-4bd0-8e70-6ca440a29b9d
McAfee BankshotATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5df525ae-d983-4fde-ac10-b07a820d9046
Google TAG Lazarus Jan 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e28da21-d977-4488-a8dc-10bad0833374
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f055076-79d1-44e8-95cb-43fc515df2f6
Novetta Blockbuster Loaders · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0431
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--636c3816-21ed-46f7-8837-2334bed88e42
US-CERT HOTCROISSANT February 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0246
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64175a23-67fa-4fa6-8aa6-890c9dc3d5d8
US-CERT HARDRAIN March 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6441d8c3-861f-4ce3-9121-809d2b0d173b
Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64a17aba-5182-4666-bd37-dafa9d835fe8
Novetta Blockbuster RATs · Novetta Blockbuster · Qualys LolZarus · Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6549c38d-46b4-4633-a479-0cbeb405f186
ESET Twitter Ida Pro Nov 2021 · TrendMicro macOS Dacls May 2020 · Qualys LolZarus · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018 · SentinelOne Lazarus macOS July 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--670a7586-5833-4e00-903a-c699b9810c13
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--699ddfef-6e95-42cf-b212-dc661f790adc
TrendMicro macOS Dacls May 2020 · Novetta Blockbuster Loaders · Novetta Blockbuster · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecretATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ab291a5-8061-4ad4-a6a7-07a6142e4c27
Novetta Blockbuster RATs · Novetta Blockbuster · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f08abbe-2b04-482f-98ec-ae9382ba3084
Novetta Blockbuster Loaders · Novetta Blockbuster Tools · Novetta Blockbuster · US-CERT SHARPKNOT June 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7104b56f-06ef-4888-ab9b-fac77fea3097
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1561.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78ca7fcf-95b9-485c-a87b-2ac083312885
Novetta Blockbuster Destructive MalwareATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79904c38-8fb6-45e3-98f7-98856e08421f
Novetta Blockbuster Destructive MalwareATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79f7d5d7-acbf-4f7e-8530-2f7e637580cd
SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0271
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b18b0b1-1116-4e42-90b5-ffa3059955a7
US-CERT KEYMARBLE Aug 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b4ee7bc-3a27-4142-a9bd-f65787193e8b
McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c1e0451-66d7-4445-9b8d-8d9770043421
Qualys LolZarus · Lazarus APT January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1542.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ca1b40d-d1de-48ab-b8ad-023ad9877def
Novetta Blockbuster Destructive Malware · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cd04afd-b216-468b-a4af-71700c9fbefd
ESET Twitter Ida Pro Nov 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e2b9c63-69ac-4050-b057-2fe16ef1d355
CISA AppleJeus Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f695d14-17e1-46c6-92eb-7c2f57fc6553
Novetta Blockbuster Tools · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6
Novetta Blockbuster RATs · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81682d49-acb2-4439-a7da-1a28126cea94
McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--829f88fc-453a-40d1-8566-90dfe0934173
RATANKBA · Google TAG Lazarus Jan 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83ba5b2c-b3fd-4558-a3f8-cef4c31e02bd
Novetta Blockbuster RATs · Novetta BlockbusterATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83bfee39-b6c9-48e6-8114-54b0c623a91f
Qualys LolZarus · Lazarus APT January 2022 · McAfee Bankshot · Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0586
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83e8bdc8-6fad-4b83-92de-2b66e3e9205e
CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83f844ec-b321-4a9d-8c43-edbf6e006a6b
Lazarus APT January 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--883e2f79-5bf5-4e08-bb83-f1cd36907958
Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1560.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c58cfe5-0b71-434c-939a-329b612d2337
Novetta Blockbuster RATs · McAfee Lazarus Resurfaces Feb 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0347
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90073373-434c-403c-bbb1-779b25fccb3d
TrendMicro Lazarus Nov 2018