APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

Lazarus Group

Lazarus Group is a highly adaptive state-sponsored threat actor, attributed to the North Korean Reconnaissance General Bureau (RGB), with activity documented as early as 2009. Initially engaging in cyber espionage and disruptive operations targeting South Korean entities, the group significantly evolved to become a primary generator of illicit revenue for the DPRK regime, driven by the critical need to bypass international sanctions and fund its strategic programs and military ambitions. This shift from primarily politically motivated attacks to financially driven cybercrime, particularly large-scale financial heists and cryptocurrency theft, sets Lazarus Group apart from many state-backed actors, making it a unique cyber-economic engine for its sponsor. While often referred to broadly, Lazarus Group encompasses several specialized subgroups, such as APT38 (Bluenoroff) focusing on financial crime and Andariel on espionage, which are sometimes used interchangeably or as umbrella terms for wider North Korean cyber operations.

Directory Briefing

Top 10 Talking Points

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to Valid Accounts, External Remote Services, Exploit Public-Facing Application, and Spearphishing Link; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

The retained sequence includes Application Window Discovery, System Network Configuration Discovery, Internet Connection Discovery, Remote System Discovery, and OS Credential Dumping, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.^1,2

Evidence includes OS Credential Dumping, LSASS Memory, NTDS, and LSA Secrets; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Scheduled Task/Job, Scheduled Task, Registry Run Keys / Startup Folder, and Create Account; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

Reported tooling or behavior includes Remote Services, Remote Desktop Protocol, SMB/Windows Admin Shares, SSH, Windows Management Instrumentation, and Command and Scripting Interpreter; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Data from Local System, Data from Network Shared Drive, Data Staged, Email Collection, and Automated Exfiltration, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

Retained targeting includes Food Manufacturing, Hospitals, Public Administration, Internet Publishing, and Space & Defense across United Arab Emirates, Australia, Bangladesh, and Belgium; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type^1,2

APT Group profile

First Seen^1,2

2009-01-01

Last Seen^1,2

2026-07-02

Origin^1,2

Motivation^1,2

Information theft and espionage,Sabotage and destruction,Financial crime,Financial gain

Primary Access Pattern^1,2

T1001 - Data Obfuscation

Objective^1,2

Information theft and espionage,Sabotage and destruction,Financial crime,Financial gain

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases^1,2

APT 38APT-C-26APT38ATK117ATK3AndarielApplewormBeagleBoyzBlack ArtemisBluenoroffBureau 121COPERNICIUMCOVELLITECitrine SleetDEV-0139DEV-1222Dark SeoulDiamond SleetG0032G0082Genie SpiderGroup 77Hastati GroupHidden CobraLabyrinth ChollimaLazarusMoonstone SleetNICKEL GLADSTONENewRomanic Cyber Army TeamNickel AcademyOperation AppleJeusOperation DarkSeoulOperation GhostSecretOperation TroySapphire SleetStardust ChollimaTA404Unit 121Whois Hacking TeamZINCLazarus GroupGuardians of Peace

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

United Arab EmiratesAustraliaBangladeshBelgiumBrazilCanadaSwitzerlandChileChinaCyprusGermanyEcuadorEstoniaFranceUnited KingdomGuatemalaHong KongIsraelIndiaJapanKorea, Republic ofSri LankaMexicoNetherlandsPanamaPhilippinesPolandRomaniaRussian FederationSeychellesSwedenSingaporeThailandTurkeyTaiwan, Province of ChinaUnited StatesVietnamSouth Africa

Target Sectors¹

Food ManufacturingHospitalsPublic AdministrationInternet PublishingSpace & DefenseEnergy & UtilitiesInsuranceManagement, Scientific, and Technical Consulting ServicesPromoters of Performing Arts, Sports, and Similar EventsOther Personal ServicesJustice, Public Order, and Safety ActivitiesTelephone Apparatus ManufacturingSoftware PublishersData Processing, Hosting, and Related ServicesInvestment Banking and Securities DealingMiscellaneous IntermediationComputer Systems Design and Related ServicesNational Security&International AffairsElectrical&Electronical ManufacturingComputer Design & ServicesBankingFinanceHealthCare & Social AssistanceNational SecurityComputer Systems Design ServicesReal EstateAir TransportationConstructionRestaurantsEducational ServicesMotor Vehicle ManufacturingBusiness Schools and Computer and Management TrainingEducational Support ServicesOutpatient Care CentersOther Amusement and Recreation IndustriesReligious OrganizationsGrantmaking and Giving ServicesCivic and Social OrganizationsBusiness, Professional, Labor, Political, and Similar OrganizationsElectronics and Appliance StoresFreight Transportation ArrangementNewspaper PublishersPeriodical PublishersMotion Picture and Video ProductionAll Other Information ServicesPortfolio ManagementResearch and Development in the Social Sciences and HumanitiesAdvertising AgenciesPublic Relations AgenciesPhotographic ServicesEmployment Placement Agencies and Executive Search ServicesInvestigation, Guard, and Armored Car ServicesConvention and Trade Show OrganizersMiningTelecommunicationsInformation ServicesArts & EntertainmentCryptoCurrency & NFTHuman Resources Consulting ServicesOffices of LawyersTravel Agencies

Associated Activity^1,2

Initial Access: Recipients opening malicious documents from spear-phishing emails, often disguised as job offers, leading to downloader execution.Execution & Persistence: Execution of PowerShell commands to explore victim environments and launch malicious DLLs, creation and renaming of folders, and use of scheduled tasks for persistence.Malware Deployment: Deployment of RATs like RATANKBA, Manuscrypt, or ScoringMathTea via compromised websites or malicious attachments.Defense Evasion: Renaming of malicious code to appear as legitimate files (e.g., Microsoft narrator, JPEG), use of multi-stage malware injecting components into separate processes, and host profiling for VM/sandbox evasion.Command and Control: Encrypted C2 traffic using custom XOR operations or AES encryption, and connections to compromised domains for C2 infrastructure.Credential Access & Discovery: Use of tools like Mimikatz for credential dumping and Nmap for network enumeration.Data Exfiltration: Use of file stealers like BeaverTail (for crypto wallet data) and broad file stealers, as well as clipboard stealers and keyloggers.This large and prolific group uses a variety of custom malware families, including backdoors, tunnelers, data miners, and destructive malware to steal millions of dollars from financial institutions and render victim networks inoperable.APT38 has conducted operations in over 16 organizations in at least 11 countries. This group is careful, calculated, and has demonstrated a desire to maintain access to victim environments for as long as necessary to understand the network layout, required permissions, and system technologies to achieve its goals. APT38 is unique in that they are not afraid to aggressively destroy evidence or victim networks as part of their operations.

ATT&CK IDs^1,2

T1001 - Data ObfuscationT1001.003 - Protocol ImpersonationT1002T1003 - OS Credential DumpingT1003.001 - LSASS MemoryT1003.003 - NTDST1003.004 - LSA SecretsT1005 - Data from Local SystemT1007T1008 - Fallback ChannelsT1010 - Application Window DiscoveryT1011T1011.001 - Exfiltration Over BluetoothT1012 - Query RegistryT1014 - RootkitT1016 - System Network Configuration DiscoveryT1016.001 - Internet Connection DiscoveryT1017 - Application Deployment SoftwareT1018 - Remote System DiscoveryT1020 - Automated ExfiltrationT1020.001 - Traffic DuplicationT1021 - Remote ServicesT1021.001 - Remote Desktop ProtocolT1021.002 - SMB/Windows Admin SharesT1021.004 - SSHT1021.006 - Windows Remote ManagementT1022T1023 - Shortcut ModificationT1024 - Custom Cryptographic ProtocolT1025T1027 - Obfuscated Files or InformationT1027.002 - Software PackingT1027.003T1027.007T1027.009T1027.013T1031 - Modify Existing ServiceT1033 - System Owner/User DiscoveryT1035 - Service ExecutionT1036 - MasqueradingT1036.003T1036.004 - Masquerade Task or ServiceT1036.005 - Match Legitimate Name or LocationT1036.006T1036.008T1037 - Boot or Logon Initialization ScriptsT1037.001 - Logon Script (Windows)T1037.003 - Network Logon ScriptT1038 - DLL Search Order HijackingT1039 - Data from Network Shared DriveT1040 - Network SniffingT1041 - Exfiltration Over C2 ChannelT1045 - Software PackingT1046T1047 - Windows Management InstrumentationT1048 - Exfiltration Over Alternative ProtocolT1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolT1049 - System Network Connections DiscoveryT1053 - Scheduled Task/JobT1053.003T1053.005 - Scheduled TaskT1055 - Process InjectionT1055.001 - Dynamic-link Library InjectionT1055.002 - Portable Executable InjectionT1055.011 - Extra Window Memory InjectionT1055.012 - Process HollowingT1056 - Input CaptureT1056.001 - KeyloggingT1056.002 - GUI Input CaptureT1056.004 - Credential API HookingT1057 - Process DiscoveryT1059 - Command and Scripting InterpreterT1059.001 - PowerShellT1059.002 - AppleScriptT1059.003 - Windows Command ShellT1059.004 - Unix ShellT1059.005 - Visual BasicT1059.006 - PythonT1059.007 - JavaScriptT1060 - Registry Run Keys / Startup FolderT1062 - HypervisorT1063 - Security Software DiscoveryT1064T1068 - Exploitation for Privilege EscalationT1069 - Permission Groups DiscoveryT1069.002 - Domain GroupsT1070 - Indicator Removal on HostT1070.001T1070.003T1070.004 - File DeletionT1070.006 - TimestompT1071 - Application Layer ProtocolT1071.001 - Web ProtocolsT1071.004 - DNST1072 - Software Deployment ToolsT1074 - Data StagedT1074.001T1076 - Remote Desktop ProtocolT1078 - Valid AccountsT1078.002 - Domain AccountsT1078.003 - Local AccountsT1078.004 - Cloud AccountsT1081 - Credentials in FilesT1082 - System Information DiscoveryT1083 - File and Directory DiscoveryT1084 - Windows Management Instrumentation Event SubscriptionT1087 - Account DiscoveryT1087.002T1089 - Disabling Security ToolsT1090 - ProxyT1090.001T1090.002T1090.003 - Multi-hop ProxyT1091T1095 - Non-Application Layer ProtocolT1098T1102 - Web ServiceT1102.001 - Dead Drop ResolverT1102.002 - Bidirectional CommunicationT1102.003 - One-Way CommunicationT1104 - Multi-Stage ChannelsT1105 - Ingress Tool TransferT1106 - Native APIT1107T1110 - Brute ForceT1110.003T1111 - Two-Factor Authentication InterceptionT1112 - Modify RegistryT1113 - Screen CaptureT1114 - Email CollectionT1115 - Clipboard DataT1119 - Automated CollectionT1124T1125 - Video CaptureT1127T1129 - Shared ModulesT1130 - Install Root CertificateT1132 - Data EncodingT1132.001 - Standard EncodingT1133 - External Remote ServicesT1134 - Access Token ManipulationT1134.001T1134.002 - Create Process with TokenT1135 - Network Share DiscoveryT1136 - Create AccountT1137 - Office Application StartupT1138 - Application ShimmingT1139 - Bash HistoryT1140 - Deobfuscate/Decode Files or InformationT1143 - Hidden WindowT1155 - AppleScriptT1176 - Browser ExtensionsT1185 - Man in the BrowserT1187 - Forced AuthenticationT1189 - Drive-by CompromiseT1190 - Exploit Public-Facing ApplicationT1192 - Spearphishing LinkT1193 - Spearphishing AttachmentT1195 - Supply Chain CompromiseT1195.001 - Compromise Software Dependencies and Development ToolsT1195.002 - Compromise Software Supply ChainT1199 - Trusted RelationshipT1202 - Indirect Command ExecutionT1203 - Exploitation for Client ExecutionT1204 - User ExecutionT1204.001 - Malicious LinkT1204.002 - Malicious FileT1207 - Rogue Domain ControllerT1210 - Exploitation of Remote ServicesT1211 - Exploitation for Defense EvasionT1212 - Exploitation for Credential AccessT1213 - Data from Information RepositoriesT1217 - Browser Bookmark DiscoveryT1218 - Signed Binary Proxy ExecutionT1218.001T1218.005T1218.007 - MsiexecT1218.010T1218.011 - Rundll32T1219 - Remote Access SoftwareT1220T1221 - Template InjectionT1404 - Exploit OS VulnerabilityT1406 - Obfuscated Files or InformationT1410 - Network Traffic Capture or RedirectionT1428 - Exploit Enterprise ResourcesT1432 - Access Contact ListT1441T1442T1444T1445 - Abuse of iOS Enterprise App Signing KeyT1449 - Exploit SS7 to Redirect Phone Calls/SMST1454 - Malicious SMS MessageT1459 - Device Unlock Code Guessing or Brute ForceT1480 - Execution GuardrailsT1480.001 - Environmental KeyingT1480.002T1485 - Data DestructionT1486 - Data Encrypted for ImpactT1489T1490 - Inhibit System RecoveryT1491T1491.001T1495T1496 - Resource HijackingT1497 - Virtualization/Sandbox EvasionT1497.001 - System ChecksT1497.002 - User Activity Based ChecksT1497.003T1498 - Network Denial of ServiceT1499 - Endpoint Denial of ServiceT1505 - Server Software ComponentT1505.003 - Web ShellT1505.004T1512 - Capture CameraT1518 - Software DiscoveryT1518.001 - Security Software DiscoveryT1528 - Steal Application Access TokenT1529T1530T1531T1534T1539 - Steal Web Session CookieT1542T1542.003T1543 - Create or Modify System ProcessT1543.001 - Launch AgentT1543.003T1543.004 - Launch DaemonT1546 - Event Triggered ExecutionT1547 - Boot or Logon Autostart ExecutionT1547.001 - Registry Run Keys / Startup FolderT1547.006T1547.008 - LSASS DriverT1547.009T1547.011 - Plist ModificationT1548 - Abuse Elevation Control MechanismT1548.002 - Bypass User Account ControlT1550 - Use Alternate Authentication MaterialT1550.002 - Pass the HashT1552 - Unsecured CredentialsT1552.001 - Credentials In FilesT1552.004 - Private KeysT1553 - Subvert Trust ControlsT1553.002 - Code SigningT1553.003 - SIP and Trust Provider HijackingT1553.005 - Mark-of-the-Web BypassT1555 - Credentials from Password StoresT1555.001 - KeychainT1555.003 - Credentials from Web BrowsersT1555.005 - Password ManagersT1556 - Modify Authentication ProcessT1556.001 - Domain Controller AuthenticationT1557 - Man-in-the-MiddleT1557.001T1559T1560 - Archive Collected DataT1560.001 - Archive via UtilityT1560.002T1560.003T1561 - Disk WipeT1561.001 - Disk Content WipeT1561.002 - Disk Structure WipeT1562 - Impair DefensesT1562.001 - Disable or Modify ToolsT1562.003T1562.004T1562.013T1563T1564 - Hide ArtifactsT1564.001T1564.003 - Hidden WindowT1565 - Data ManipulationT1565.001T1565.002T1565.003T1566 - PhishingT1566.001 - Spearphishing AttachmentT1566.002 - Spearphishing LinkT1566.003 - Spearphishing via ServiceT1567 - Exfiltration Over Web ServiceT1567.002 - Exfiltration to Cloud StorageT1568 - Dynamic ResolutionT1568.002 - Domain Generation AlgorithmsT1569T1569.002T1570 - Lateral Tool TransferT1571 - Non-Standard PortT1572 - Protocol TunnelingT1573 - Encrypted ChannelT1573.001 - Symmetric CryptographyT1573.002 - Asymmetric CryptographyT1574 - Hijack Execution FlowT1574.001 - DLL Search Order HijackingT1574.002 - DLL Side-LoadingT1574.010 - Services File Permissions WeaknessT1574.012 - COR_PROFILERT1574.013T1578 - Modify Cloud Compute InfrastructureT1580 - Cloud Infrastructure DiscoveryT1583 - Acquire InfrastructureT1583.001 - DomainsT1583.002 - DNS ServerT1583.003 - Virtual Private ServerT1583.004 - ServerT1583.005T1583.006T1584 - Compromise InfrastructureT1584.001 - DomainsT1584.002 - DNS ServerT1584.004 - ServerT1584.005 - BotnetT1585 - Establish AccountsT1585.001 - Social Media AccountsT1585.002T1586 - Compromise AccountsT1587 - Develop CapabilitiesT1587.001 - MalwareT1587.002T1587.003 - Digital CertificatesT1587.004 - ExploitsT1588 - Obtain CapabilitiesT1588.001 - MalwareT1588.002 - ToolT1588.003T1588.004 - Digital CertificatesT1589 - Gather Victim Identity InformationT1589.002T1590 - Gather Victim Network InformationT1590.005T1591 - Gather Victim Org InformationT1591.001 - Determine Physical LocationsT1591.002 - Business RelationshipsT1591.004T1592 - Gather Victim Host InformationT1592.002T1593 - Search Open Websites/DomainsT1593.001T1595 - Active ScanningT1596 - Search Open Technical DatabasesT1598T1598.003T1602.001 - SNMP (MIB Dump)T1602.002 - Network Device Configuration DumpT1608 - Stage CapabilitiesT1608.001 - Upload MalwareT1608.002T1609 - Container Administration CommandT1614T1614.001T1620T1622T1656T1680T1684T1684.001T1685T1685.005T1686T1686.002T1686.003T1690TA0002TA0002 - ExecutionTA0003TA0003 - PersistenceTA0004TA0005TA0005 - Defense EvasionTA0006TA0007TA0009TA0011TA0034TA0040

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
Operation Dream Job²	Operation Dream Job (C0022) is attributed to Lazarus Group (G0032) by MITRE ATT&CK Campaigns.

Indicators

IOCs And Observable Retention

SOCRadar reported 58115¹IntelliOS retained 53⁵

SOCRadar reports 58115 IOCs for this profile. IntelliOS currently retains 53 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 4 source groups tracked; 1 currently contributes retained observable or context rows.

Retained Observables

Showing 53 of 53

Type	Value	Source
SHA-256 Hash	5b40b73934c1583144f41d8463e227529fa7157e26e6012babd062e3fd7e0b03⁵	CISA AA22-108A
SHA-256 Hash	60b3cfe2ec3100caf4afde734cfd5147f78acf58ab17d4480196831db4aa5f18⁵	CISA AA22-108A
SHA-256 Hash	765a79d22330098884e0f7ce692d61c40dfcf288826342f33d976d8314cfd819⁵	CISA AA22-108A
SHA-256 Hash	867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36⁵	CISA AA22-108A
SHA-256 Hash	89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957⁵	CISA AA22-108A
SHA-256 Hash	8acd7c2708eb1119ba64699fd702ebd96c0d59a66cba5059f4e089f4b0914925⁵	CISA AA22-108A
SHA-256 Hash	9ba02f8a985ec1a99ab7b78fa678f26c0273d91ae7cbe45b814e6775ec477598⁵	CISA AA22-108A
SHA-256 Hash	9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa⁵	CISA AA22-108A
SHA-256 Hash	dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156⁵	CISA AA22-108A
SHA-256 Hash	e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad⁵	CISA AA22-108A
SHA-256 Hash	f0e8c29e3349d030a97f4a8673387c2e21858cccd1fb9ebbf9009b27743b2e5b⁵	CISA AA22-108A
SHA-1 Hash	8e67006585e49f51db96604487138e688df732d3⁵	CISA AA22-108A
SHA-1 Hash	b2d9ca7b6d1bbbe4864ea11dfca343b7e15597d8⁵	CISA AA22-108A
SHA-1 Hash	f1606d4d374d7e2ba756bdd4df9b780748f6dc98⁵	CISA AA22-108A
MD5 Hash	4e5ebbecd22c939f0edf1d16d68e8490⁵	CISA AA22-108A
MD5 Hash	930f6f729e5c4d5fb52189338e549e5e⁵	CISA AA22-108A
MD5 Hash	c2ea5011a91cd59d0396eb4fa8da7d21⁵	CISA AA22-108A
Filename	AlticGO.exe⁵	CISA AA22-108A
Filename	CryptAIS.dmg⁵	CISA AA22-108A
Filename	DAFOM-1.0.0.dmg⁵	CISA AA22-108A
Filename	darwin64.bin⁵	CISA AA22-108A
Filename	TokenAIS.app.zip⁵	CISA AA22-108A
Filename	win32.bin⁵	CISA AA22-108A
Network Indicator	aideck.net⁵	CISA AA22-108A
Network Indicator	alticgo.com⁵	CISA AA22-108A
Network Indicator	creaideck.com⁵	CISA AA22-108A
Network Indicator	cryptais.com⁵	CISA AA22-108A
Network Indicator	dafnefonseca.com⁵	CISA AA22-108A
Network Indicator	dafom.dev⁵	CISA AA22-108A
Network Indicator	esilet.com⁵	CISA AA22-108A
Network Indicator	greenvideo.nl⁵	CISA AA22-108A
Network Indicator	haciendadeclarevot.com⁵	CISA AA22-108A
Network Indicator	infodigitalnew.com⁵	CISA AA22-108A
Network Indicator	sche-eg.org⁵	CISA AA22-108A
Network Indicator	tokenais.com⁵	CISA AA22-108A
Network Indicator	www.vinoymas.ch⁵	CISA AA22-108A
Network Indicator	https://aideck.net/board.php⁵	CISA AA22-108A
Network Indicator	https://dafnefonseca.com/wp-content/themes/top.php⁵	CISA AA22-108A
Network Indicator	https://greenvideo.nl/wp-content/themes/top.php⁵	CISA AA22-108A
Network Indicator	https://haciendadeclarevot.com/wp-content/top.php⁵	CISA AA22-108A
Network Indicator	https://infodigitalnew.com/wp-content/plugins/top.php⁵	CISA AA22-108A
Network Indicator	https://sche-eg.org/plugins/top.php⁵	CISA AA22-108A
Network Indicator	https://www.alticgo.com/update/⁵	CISA AA22-108A
Network Indicator	https://www.esilet.com/update/⁵	CISA AA22-108A
Network Indicator	https://www.vinoymas.ch/wp-content/plugins/top.php⁵	CISA AA22-108A
Network Indicator	104.168.98.156⁵	CISA AA22-108A
Network Indicator	108.170.55.202⁵	CISA AA22-108A
Network Indicator	199.188.103.115⁵	CISA AA22-108A
Network Indicator	38.132.124.161⁵	CISA AA22-108A
Network Indicator	45.14.227.58⁵	CISA AA22-108A
Network Indicator	82.102.31.14⁵	CISA AA22-108A
Network Indicator	89.45.4.151⁵	CISA AA22-108A
Campaign Context	Thin Lazarus Group row backfilled from the same CISA TraderTraitor, MITRE G0032, and Google/Mandiant source set as the SOCRadar Lazarus card; IntelliOS preserves source-boundary notes around APT38 and related North Korea naming.⁵	CISA AA22-108A

Source	Reported	Retained	Coverage Status
SOCRadar¹	58115	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
CISA/FBI/Treasury⁵	N/A	53	Public observables or source-context rows retained and displayed.
MITRE ATT&CK²	N/A	0	Context source retained; no direct observable rows retained from this source yet.
Google/Mandiant⁴	N/A	0	Context source retained; no direct observable rows retained from this source yet.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Lazarus Group	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Lazarus Group	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Lazarus Group, then compares naming and aliases against SOCRadar Actor Alias Index where collision checks exist.

The retained collision rows point to possible boundary questions involving Lazarus Group / Silent Chollima; Lazarus Group / UNC4736 based on shared evidence such as OperationTroy, Andariel; Citrine Sleet. These notes preserve reader context; IntelliOS does not automatically merge actor records.

Collision Source	Candidate Records	Shared Evidence	Treatment
SOCRadar Actor Alias Index possible same actor	Lazarus Group / Silent Chollima	OperationTroy, Andariel	Retain as a source-boundary note; do not merge automatically.
SOCRadar Actor Alias Index possible same actor	Lazarus Group / UNC4736	Citrine Sleet	Retain as a source-boundary note; do not merge automatically.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	MITRE ATT&CK https://attack.mitre.org/groups/G0032	ATT&CK source for group, campaign, software, alias, and technique mappings where matched.
3	MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json	Open MITRE CTI source for ATT&CK data.
4	Google Cloud Security: APT Groups https://cloud.google.com/security/resources/insights/apt-groups	Threat Actor Profile
5	CISA AA22-108A: TraderTraitor North Korean APT targets blockchain companies https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a	IOC Source

Loading Threat Actor Cards

Lazarus Group

Top 10 Talking Points

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

BLUF

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

Lazarus Group should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2