MITRE ATT&CK G0032
Lazarus Group
View MITRE Group Page ↗
Aliases: HIDDEN COBRA, Guardians of Peace, Zinc, APT38, Labyrinth Chollima
Official Attribution Source: U.S. Department of Justice Indictment (C.D. Cal.)
Key Facts
Jurisdiction
Democratic People's Republic of Korea
Geographic origin
Cases
1
Prosecution matters
Defendants
1
Indicted individuals
Sanctions
2
OFAC designations
- Attributed Country: Democratic People's Republic of Korea.
- ATT&CK Group Reference: G0032 (Lazarus Group).
- Linked to 1 primary court prosecution records.
- Identified 1 individually charged operatives.
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1485 Data Destruction | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1021.002 SMB / Windows Admin Shares | 1 incidents |
| T1566.002 Spearphishing Link | 1 incidents |
| T1027 Obfuscated Files or Information | 1 incidents |
| T1001.002 Steganography | 1 incidents |
| T1068 Exploitation for Privilege Escalation | 1 incidents |
Prosecution Cases Attributed to This Actor
fugitive 2018-06-08
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
7 techniques
View case →
Treasury OFAC Sanctions Actions
Tornado Cash Virtual Currency Mixer 2022-08-08
Decentralized cryptocurrency mixer used by the Lazarus Group to launder over $455 million in stolen crypto.
Official Treasury Press Release ↗ Lazarus Group (Reconnaissance General Bureau) 2019-09-13
North Korean state-sponsored hacking organization responsible for WannaCry, Sony Pictures hack, and crypto heists.
Official Treasury Press Release ↗