Lazarus Group
Operation DarkSeoulDark SeoulHidden CobraHastati GroupAndarielUnit 121Bureau 121NewRomanic Cyber Army TeamBluenoroffSubgroup: BluenoroffGroup 77Labyrinth ChollimaOperation TroyOperation GhostSecretOperation AppleJeusAPT38
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote… Source: MISP
Attributed country: KP according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 27 Oct 2026 · last seen on 27 Oct 2026
News
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum EncryptionThe Hacker News · 27 Oct 2026
MITRE ATT&CK techniques
Reconnaissance
Resource Development
T1583.001DomainsT1583.006Web ServicesT1584.004ServerT1585.001Social Media AccountsT1585.002Email AccountsT1587.001Malware 10 Sigma rulesT1588.002Tool 7 Sigma rulesT1588.004Digital Certificates
Initial Access
T1078Valid Accounts 82 Sigma rulesT1189Drive-by Compromise 3 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rulesT1566.003Spearphishing via Service
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1106Native API 12 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1574.001DLL 40 Sigma rulesT1574.013KernelCallbackTable
Persistence
T1098Account Manipulation 36 Sigma rulesT1542.003Bootkit 1 Sigma rulesT1543.003Windows Service 40 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rulesT1547.009Shortcut Modification 4 Sigma rules
Privilege Escalation
T1055.001Dynamic-link Library Injection 7 Sigma rulesT1134.002Create Process with Token 7 Sigma rules
Credential Access
T1056.001Keylogging 3 Sigma rulesT1110.003Password SprayingT1557.001Name Resolution Poisoning and SMB Relay 10 Sigma rules
Discovery
T1010Application Window Discovery 1 Sigma rulesT1012Query Registry 11 Sigma rulesT1016System Network Configuration Discovery 4 Sigma rulesT1033System Owner/User Discovery 26 Sigma rulesT1046Network Service Discovery 17 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1057Process Discovery 3 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1124System Time Discovery 1 Sigma rulesT1680Local Storage Discovery
Lateral Movement
T1021.001Remote Desktop Protocol 16 Sigma rulesT1021.002SMB/Windows Admin Shares 35 Sigma rulesT1021.004SSH 5 Sigma rules
Collection
T1005Data from Local System 12 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1560Archive Collected Data 11 Sigma rulesT1560.002Archive via LibraryT1560.003Archive via Custom Method
Command and Control
T1001.003Protocol or Service Impersonation 2 Sigma rulesT1008Fallback Channels 4 Sigma rulesT1071.001Web Protocols 39 Sigma rulesT1090.001Internal Proxy 6 Sigma rulesT1090.002External Proxy 2 Sigma rulesT1102.002Bidirectional Communication 3 Sigma rulesT1104Multi-Stage ChannelsT1105Ingress Tool Transfer 40 Sigma rulesT1132.001Standard Encoding 4 Sigma rulesT1571Non-Standard Port 5 Sigma rulesT1573.001Symmetric Cryptography
Exfiltration
T1041Exfiltration Over C2 Channel 4 Sigma rulesT1048.003Exfiltration Over Unencrypted Non-C2 Protocol 7 Sigma rules
Impact
T1485Data Destruction 15 Sigma rulesT1489Service Stop 13 Sigma rulesT1491.001Internal Defacement 3 Sigma rulesT1529System Shutdown/Reboot 6 Sigma rulesT1561.001Disk Content Wipe 1 Sigma rulesT1561.002Disk Structure Wipe 1 Sigma rules
Stealth
T1027.007Dynamic API ResolutionT1027.009Embedded Payloads 1 Sigma rulesT1027.013Encrypted/Encoded FileT1036.003Rename Legitimate Utilities 25 Sigma rulesT1036.004Masquerade Task or Service 3 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070Indicator Removal 42 Sigma rulesT1070.003Clear Command History 9 Sigma rulesT1070.004File Deletion 9 Sigma rulesT1070.006Timestomp 4 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1202Indirect Command Execution 38 Sigma rulesT1218System Binary Proxy Execution 137 Sigma rulesT1218.005Mshta 8 Sigma rulesT1218.011Rundll32 40 Sigma rulesT1564.001Hidden Files and Directories 7 Sigma rulesT1620Reflective Code Loading 3 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗