North KoreaAttributedRGB 3rd Bureau, Lab 110MixedActive 2009 – 2026Lazarus Group
Also known asLazarus · HIDDEN COBRA · Guardians of Peace · ZINC · Diamond Sleet · Labyrinth Chollima · Group 77 · Hastati Group · Whois Hacking Team · NewRomanic Cyber Army Team · APT-C-26 · Appleworm · Nickel Academy · Dark Seoul · LolZarus · Bureau 121 · Unit 121 · TEMP.Hermit · UNC577 · Black Artemis · Selective Pisces · ATK3
Summary
Umbrella designation for DPRK Reconnaissance General Bureau cyber operations. Record ~$2.02B in cryptocurrency theft in 2025 (FBI/Chainalysis) — reinvested directly into DPRK weapons programmes. Feb 2025: $1.5B Bybit heist — largest single crypto theft on record (TraderTraitor subcluster, FBI attributed). Jan 2025: Operation 99 — targeting Web3 and crypto developers via fake job recruiter npm/PyPI packages (CrowdStrike: Labyrinth Chollima). Dec 2024–2025: Operation DreamJob expanded to nuclear-sector employees using CookiePlus modular backdoor (Kaspersky). May 2024 (reported Oct 2024): Chrome zero-day CVE-2024-4947 exploited via a fake DeFi tank-game site, detankzone (Kaspersky). Since Oct 2024: AI-driven techniques integrated into social engineering campaigns. 2026: expanding focus to cloud infrastructure, developer environments, and software supply chains. Tracked separately here: BlueNoroff (SWIFT/crypto), Andariel (espionage/ransomware), Jade Sleet / TraderTraitor (CrowdStrike PRESSURE CHOLLIMA; crypto heists, developer supply chain), AppleJeus / Citrine Sleet (trojanised crypto apps, 3CX), Moonstone Sleet (fake companies, games, ransomware) and Jasper Sleet (remote IT workers). This record keeps the Diamond Sleet / TEMP.Hermit core — Dream Job espionage, which CrowdStrike since Jan 2026 tracks narrowly as LABYRINTH CHOLLIMA. Laundering via Tornado Cash successors, OFAC-sanctioned mixers.
Attribution
Lab 110 is widely read as a reorganised Bureau 121
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Treasury (OFAC) (Government, 2019-09-13)
Sanctions: subordinate to the 110th Research Center, 3rd Bureau of the RGB - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to the Reconnaissance General Bureau - Mandiant (Research, 2022-03-23)
Lab 110 is likely a reorganised Bureau 121
Campaigns 11
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Bitget hot-wallet theft (~$387M) — DPRK-attributed; TraderTraitor link contestedASSESSED | 2026-09 | Global | Cryptocurrency | Chainalysis (2026-10-01); BlockSec (2026-09-30) — Lazarus umbrella; sub-group not identified (TraderTraitor/Jade Sleet link claimed, contested) |
| Operation DreamJob restarted — drone/UAS defence OEMs in Europe | 2026-06 – 2026-09 | Europe | Defense, Aerospace | ESET Research (2026-10-28) — restart "around June 2026"; end is the close of ESET's reporting period |
| Operation DreamJob — MFC-app loaders and new BlindingCan against South Korean newspaper and pharmaceutical firms | 2026-02 – 2026-03 | South Korea | Media, Pharmaceutical | ESET APT Activity Report Q4 2025–Q1 2026 (2026-05-28) |
| Operation Dream Job — 2026 wave (SecurityPDF / Troy, AFD.sys zero-day) | 2026-01 – ongoing | France, Germany, India, Brazil, Western Europe | Defense, Aerospace | Check Point Research (2026-08-11) |
| Medusa ransomware — Middle East victim and attempted US healthcare intrusion (Comebacker) | 2025-11 – 2026-02 | Middle East, USA | Healthcare, Non-profit | Symantec and Carbon Black (2026-02-24) — Lazarus umbrella; sub-group not identified |
| Drift Protocol theft (~$285M) — months-long social engineering; DPRK subgroup not yet namedASSESSED | 2025-10 – 2026-04 | Global | Cryptocurrency, DeFi | TRM Labs (2026-04-30); Elliptic (2026-04-02) |
| Operation FlashHole — CrossWeb EX abuse and tailored spear-phishing against South Korean software, construction and communications-equipment firms | 2025-07 – 2026-01 | South Korea | Software Development, Construction, Communications equipment | Kaspersky GReAT (2026-10-21) |
| Operation DreamJob — European defence/UAV wave | 2025-03 – 2025 | EU | Defence, Aerospace | ESET (2025-10-23) |
| Bybit theft — cross-reference (TraderTraitor; canonical record under Jade Sleet) | 2025-02 | UAE | Financial, Cryptocurrency | FBI IC3 PSA I-022625-PSA (2025-02-26) |
| South Korean financial-security-software exploitation & watering holesASSESSED | 2025 – 2026 | South Korea | Government, Cryptocurrency, IT Services | The Record (2026-07-30), reporting AhnLab "Operation Double Barrel" and the NIS/NPA/KISA/FSI joint advisory — the originators name only a "state-sponsored threat group"; the Lazarus attribution is The Record's and Korean industry's |
| Operation SyncHole — Cross EX abuse, Innorix Agent lateral movement and watering holes against South Korean firms | 2024-11 – 2025-02 | South Korea | Software Development, IT, Financial Services, Semiconductors, Telecommunications | Kaspersky GReAT (2025-04-24) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 15
| Initial Access3 | T1566.002Spearphishing LinkT1195Supply Chain CompromiseT1195.002Compromise Software Supply Chain |
|---|---|
| Execution2 | T1059.001PowerShellT1059.007JavaScript |
| Persistence1 | T1505.003Web Shell |
| Privilege Escalation1 | T1068Exploitation for Privilege Escalation |
| Stealth4 | T1055Process InjectionT1027Obfuscated Files or InformationT1014RootkitT1027.009Embedded Payloads |
| Credential Access1 | T1003OS Credential Dumping |
| Discovery1 | T1680Local Storage Discovery |
| Impact2 | T1486Data Encrypted for ImpactT1657Financial Theft |
Malware and tools 22
| Name | Description | Platform |
|---|---|---|
| CookiePlus | Backdoor | Windows |
| MagicRAT | RAT (Qt) | Windows |
| NukeSped | RAT | Windows |
| AppleJeus | Crypto-theft Trojan | macOS/Windows |
| WannaCry | Ransomware Worm | Windows |
| ELECTRICFISH | Tunneling | Windows |
| FudModule | Kernel Rootkit (BYOVD) | Windows |
| LightlessCan | Modular Backdoor | Windows |
| Troy | Backdoor | Windows |
| MISTPEN | In-memory downloader (Graph API/OneDrive C2) | Windows |
| ForestTiger | Backdoor | Windows |
| RelayShell | PHP Web Shell (C2 relay) | Linux/Web |
| Comebacker | Backdoor / loader | Windows |
| BlindingCan | RAT | Windows |
| Medusa Ransomware | Ransomware (RaaS, operated by Spearwing) | Windows |
| ThreatNeedle | Backdoor (flagship) | Windows |
| SIGNBT | Backdoor (second stage) | Windows |
| LPEClient | Loader / profiler | Windows |
| TouchShift | DLL side-loaded loader | Windows |
| IMETHOD | Backdoor (ThreatNeedle predecessor; in use since at least 2016) | Windows |
| MortPusLoader | Loader (trojanised Notepad++ plugins) | Windows |
| LightlessTeaR | Backdoor (LightlessCan rewrite) | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2025-49113 | 9.9 | Roundcube Webmail — PHP object deserialization RCE (KEV 2026-02-20) |
| CVE-2018-4878 | 7.8 | Adobe Flash Player — use-after-free RCE (KEV 2021-11-03) |
| CVE-2026-68820 | 7 | Windows Ancillary Function Driver (AFD.sys) — use-after-free LPE zero-day (KEV 2026-08-11) |
Highest CVSS first.
Infrastructure patterns
- Compromised Roundcube and WordPress servers as C2 relays via RelayShell (Check Point, 2026)
- Compromised legitimate South Korean websites as C2 servers (Kaspersky, 2025; Kaspersky, 2026)
- GitHub repositories as C2 since at least July 2025; Dropbox in one sample (Kaspersky, 2026)
- Compromised Roundcube servers of South American academic and government bodies as C&C (ESET, 2026)
Reporting and advisories 10
- DoJ
Indictment — Park Jin Hyok (2018) & Jon Chang Hyok (2021) - ESET
Operation DreamJob — European defence/UAV wave - Check Point Research
Operation Dream Job — 2026 wave (SecurityPDF / Troy, AFD.sys zero-day) - The Record, reporting AhnLab and a South Korean joint advisory (Lazarus named by the press)
South Korean financial-security-software exploitation & watering holes - TRM Labs
Drift Protocol theft (~$285M) — months-long social engineering; DPRK subgroup not yet named - MITRE ATT&CK
Lazarus Group (G0032) group profile - Symantec and Carbon Black
Medusa ransomware — Middle East victim and attempted US healthcare intrusion (Comebacker) - Kaspersky GReAT
Operation FlashHole (21 Oct 2026) - Kaspersky GReAT
Operation SyncHole (24 Apr 2025) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)