Lazarus Group
Threat actorAttributed to North Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Lazarus GroupOur name
- Labyrinth ChollimaCrowdStrike
- Diamond SleetMicrosoft
- ZINCMicrosoft
- Guardians of PeaceMITRE ATT&CK
- HIDDEN COBRAMITRE ATT&CK
- NICKEL ACADEMYSecureworks
Known techniques
- T1001.003Protocol or Service Impersonation
- T1005Data from Local System
- T1008Fallback Channels
- T1010Application Window Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1021.001Remote Desktop Protocol
- T1021.002SMB/Windows Admin Shares
- T1021.004SSH
- T1027.007Dynamic API Resolution
- T1027.009Embedded Payloads
- T1027.013Encrypted/Encoded File
- T1033System Owner/User Discovery
- T1036.003Rename Legitimate Utilities
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1041Exfiltration Over C2 Channel
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1055.001Dynamic-link Library Injection
- T1056.001Keylogging
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1070Indicator Removal
- T1070.003Clear Command History
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1074.001Local Data Staging
- T1078Valid Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1090.001Internal Proxy
- T1090.002External Proxy
- T1098Account Manipulation
Malware and tools used
Recent news
FBI blames North Korean TraderTraitor group for $6.3B Binance crypto theft
Binance attributed the $6.3 billion theft to a compromised DevOps engineer's laptop, which gave attackers access to a withdrawal service container and let them authorise unauthorised withdrawals. The FBI has attributed the attack to North Korea's TraderTraitor group, linked to Lazarus, and has published wallet addresses tied to the theft. Binance says it has replenished about 95 percent of the stolen assets, resumed withdrawals in phases, and recorded about $3.64 billion in net outflows.
FBI attributes over $6 billion Binance crypto theft to North Korea's TraderTraitor
The FBI, with the US Secret Service and IRS-CI, attributes the theft of more than $6 billion from Binance on or about 29 October 2026 to North Korean group TraderTraitor. Attackers reached a service container through an engineer's laptop and sent unauthorised withdrawal requests, and Binance reports no private keys were stolen. Freezes by issuers and others covered only part of the funds, and the attacker still holds over 420,000 ETH and 18,270 BTC.