Lazarus Group (Hidden Cobra, Diamond Sleet, Labyrinth Chollima), Adversary Emulation Profile

Lazarus Group (MITRE ATT&CK G0032) is a North Korean state-sponsored threat actor active since at least 2009 and attributed by the U.S. Government and the security industry to the DPRK's Reconnaissance General Bureau (RGB). It is one of the most versatile and prolific nation-state actors observed, running three overlapping mission types in parallel: strategic espionage, destructive/disruptive attacks (e.g., the 2014 Sony Pictures wiper and the 2017 WannaCry outbreak), and large-scale financially motivated theft to fund the sanctioned regime (SWIFT bank fraud, ATM "FASTCash" cash-outs, and cryptocurrency heists). MITRE and vendors track several clusters/aliases under or alongside the Lazarus umbrella, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet (Microsoft), and Labyrinth Chollima (CrowdStrike), with financial sub-clusters often labeled APT38 / BlueNoroff / Stardust Chollima. The group blends bespoke malware, trojanized legitimate software, supply-chain compromise, and elaborate social engineering (fake recruiter "job offers") to reach hardened targets.