North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.
New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.
- Lazarus umbrella split into six clusters based on TTPs and operations
- Former APT38 likely divided into CryptoCore and Jade Sleet
- Moonstone Sleet pairs espionage with Qilin RaaS and custom malware
- Fake IT worker program tied to $62.5M Munchables theft
- Fake IT workers aid sanctions evasion and espionage access
- Vendors
- SekoiaKudelski Security
- Threat actors
- Lazarus GroupMoonstone SleetFamous ChollimaCitrine SleetJade SleetCryptoCoreTEMP.HermitAndarielQilin
- Victims
- Munchables
- Organizations
- GRIB
- Countries
- North Korea
From the original article
2 min read at infosecurity-magazine.com
Sekoia and Kudelski Security have observed that North Korea's Lazarus umbrella is split into six distinct clusters, focused on espionage, financial theft and sanctions evasion
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.