# Lazarus Group

Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill lazarus-group -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill lazarus-group -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill lazarus-group -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill lazarus-group -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Lazarus Group (Hidden Cobra, Diamond Sleet, Labyrinth Chollima), Adversary Emulation Profile

Lazarus Group (MITRE ATT&CK **G0032**) is a North Korean state-sponsored threat actor active since at least 2009 and attributed by the U.S. Government and the security industry to the DPRK's Reconnaissance General Bureau (RGB). It is one of the most versatile and prolific nation-state actors observed, running three overlapping mission types in parallel: strategic **espionage**, **destructive/disruptive** attacks (e.g., the 2014 Sony Pictures wiper and the 2017 WannaCry outbreak), and large-scale **financially motivated** theft to fund the sanctioned regime (SWIFT bank fraud, ATM "FASTCash" cash-outs, and cryptocurrency heists). MITRE and vendors track several clusters/aliases under or alongside the Lazarus umbrella, **HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet (Microsoft), and Labyrinth Chollima (CrowdStrike)**, with financial sub-clusters often labeled APT38 / BlueNoroff / Stardust Chollima. The group blends bespoke malware, trojanized legitimate software, supply-chain compromise, and elaborate social engineering (fake recruiter "job offers") to reach hardened targets.

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/lazarus-group/SKILL.md