Lazarus Group is a highly adaptive state-sponsored threat actor, attributed to the North Korean Reconnaissance General Bureau (RGB), with activity documented as early as 2009. Initially engaging in cyber espionage and disruptive operations targeting South Korean entities, the group significantly evolved to become a primary generator of illicit revenue for the DPRK regime, driven by the critical need to bypass international sanctions and fund its strategic programs and military ambitions. This shift from primarily politically motivated attacks to financially driven cybercrime, particularly large-scale financial heists and cryptocurrency theft, sets Lazarus Group apart from many state-backed actors, making it a unique cyber-economic engine for its sponsor. While often referred to broadly, Lazarus Group encompasses several specialized subgroups, such as APT38 (Bluenoroff) focusing on financial crime and Andariel on espionage, which are sometimes used interchangeably or as umbrella terms for wider North Korean cyber operations.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.