Lazarus Group

Individuals profiled under this label are charged in one U.S. case covering the 2014 destruction of Sony Pictures' network, the 2016 theft of $81 million from Bangladesh Bank through fraudulent SWIFT messages, and the 2017 WannaCry worm.

"Lazarus" is also the loosest label here: coined for the Sony intrusion, it now covers most RGB-linked activity that fits no narrower name. This site applies it only where the cited source does. MITRE tracks AppleJeus separately (G1049), so it is not listed as an alias.

Named individuals

3 profiled from law-enforcement records

Fabricated personas

None reconstructed under this tag

Indicators

2,718 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

Unlike APT38 or the IT-worker cluster, it need not stay quiet: Sony saw wiper malware, published stolen email and an invented hacktivist claim.

WannaCry spread indiscriminately enough to disrupt hospitals in countries with no connection to any dispute.

The charging documents attribute through overlapping malware code, shared build artefacts, reused accounts and infrastructure; a Lazarus claim should offer similar evidence.

Compare APT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37KonniMoonstone SleetPolinRider

What a defender would see

Nothing under this label is a live indicator; most reported infrastructure is long dead and shows past use, not current activity.

Use the label for corroboration: a sound report argues shared code, build environments and reused accounts, not just a synonym for North Korea.

Every person below is named in a public charging document, sanctions record or law-enforcement wanted notice that carries this cluster tag. Each profile lists the records it draws on and nothing beyond them.

• Jon Chang Hyok전창혁
• Kim Il김일
• Park Jin Hyok박진혁

Indicators

The 2,718 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe U.S. Department of Justice · 2021-02-17

  The charging document behind all three individuals profiled here, and the clearest single account of how one indictment came to cover Sony, Bangladesh Bank and WannaCry at once.

• North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions U.S. Department of Justice · 2018-09-06

  The 2018 Park Jin Hyok complaint and its press release. Worth reading for the attribution method rather than the outcome: the linked complaint sets out at length the shared accounts, code and infrastructure the case is built on.

• North Korea Designations — SDN List additions for Park Jin Hyok and Chosun Expo Joint Venture U.S. Treasury, Office of Foreign Assets Control · 2018-09-06

  The sanctions action taken the same day. Short, and useful for the named front company, which is the thread much of the later reporting on this cluster picks up.

• TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) FBI, CISA and U.S. Treasury · 2022-04-18

  How the label is applied after 2022. Reads as a direct continuation of the bank-heist tradecraft moved onto cryptocurrency firms, which is the argument for treating the umbrella as one lineage rather than a catch-all.

• AppleJeus, Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736: MITRE ATT&CK group entry (G1049) MITRE · 2026-07-31

  The separate MITRE group ID behind the note above. States plainly that this activity is associated with the broader Lazarus Group umbrella and closely aligned with TEMP.Hermit, while still tracking it under its own ID.

• North Korean threat actor Citrine Sleet exploiting Chromium zero-day Microsoft Threat Intelligence · 2024-08-30

  Microsoft's own reporting on the Citrine Sleet name, which its naming page separately maps to Labyrinth Chollima rather than to a Sapphire Sleet/BlueNoroff lineage.

• Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors Unit 42 (Palo Alto Networks) · 2024-09-18

  The source for Unit 42's own description of Gleaming Pisces/AppleJeus as "a sub-cluster within the Lazarus Group", and for the PondRAT and POOLRAT backdoors tying it to the wider umbrella.

• Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware Unit 42 (Palo Alto Networks) · 2025-04-14

  Unit 42's own name for the Jade Sleet/UNC4899/TraderTraitor activity, and the source for its alias list.

• Assessed Cyber Structure and Alignments of North Korea in 2023 Mandiant (Google Cloud) · 2023-10-10

  The source for Mandiant's hedged language on UNC4736, UNC4899 and UNC1069 — "overlaps with", "may be the work of", "may include individuals or units previously tracked as" — which is the level of confidence this site tries to preserve rather than round up.

• How Microsoft names threat actors Microsoft Learn · 2026-08-18

  Microsoft's own alias table, and the source for filing both Citrine Sleet and Jade Sleet under this cluster's Labyrinth Chollima and Diamond Sleet lineage rather than under Sapphire Sleet.