financial

Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff

active · last signal 1mo agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

Financially motivated

Lazarus GroupAPT38BlueNoroffBluenoroffTraderTraitorBeagleBoyzStardust ChollimaSapphire SleetNICKEL GLADSTONECOPERNICIUMHidden CobraZINCDiamond SleetGuardians of PeaceWhois TeamLabyrinth Chollima

Attribution

Attributed by the U.S. Government (CISA/FBI/Treasury), Mandiant/FireEye, Kaspersky and others to the Democratic People's Republic of Korea (DPRK), specifically the Reconnaissance General Bureau (RGB) — the DPRK's primary foreign intelligence service (units commonly referenced as Bureau 121 / Lab 110). Attribution confidence: HIGH for state sponsorship and DPRK/RGB origin (corroborated by multiple government advisories, a DOJ indictment, and independent vendor telemetry). The internal cluster taxonomy is looser: 'Lazarus Group' is often used as an umbrella for all DPRK activity, while APT38 (MITRE G0082), BlueNoroff and TraderTraitor are financially-motivated subclusters that many vendors track separately; boundaries between them overlap and are drawn differently by different reporters (MEDIUM confidence on exact subcluster demarcation). MITRE tracks Lazarus as G0032 and APT38 as G0082, and folds BlueNoroff under APT38/G0082.

Origin

North Korea

First seen

2009 (Lazarus umbrella activity, e.g. Operation Troy DDoS attacks; financially-focused APT38 subcluster active since at least 2014)

Last active

2025 (FBI attribution of the ~$1.5B Bybit crypto heist to the TraderTraitor cluster, February 2025)

Motivation

Dual-purpose: (1) financial gain / revenue generation for the sanctioned DPRK regime — bank heists, ATM cash-outs and large-scale cryptocurrency theft used to fund state programs including WMD/ballistic-missile development; and (2) state-directed objectives — espionage, and in some operations destructive/disruptive attacks (e.g. Sony 2014, WannaCry 2017). The financial subclusters (APT38, BlueNoroff, TraderTraitor) are primarily money-driven; the broader Lazarus umbrella also conducts espionage and sabotage.

Attribution confidence

high

MENA targeting

UAE

Sectors

Cryptocurrency / virtual asset exchange

MITRE ATT&CK

G0032 ↗

Corpus activity · 6mo1 mention

AMJJAS

Why it mattersFinancially-motivated actor, high confidence, documented targeting UAE (Cryptocurrency / virtual asset exchange sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Attributed to

Operation Dream JobATT&CK campaignATT&CK Campaign2019-09-01

Related to

MuddyWateractorTechnique overlap
OilRig (APT34)actorTechnique overlap
APT39 / ChaferactorTechnique overlap
Cl0pactorTechnique overlap
Tropic TrooperactorTechnique overlap
Qilin (fka Agenda)actorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap

Diamond Model

The four features of this adversary's intrusions under the Diamond Model — adversary, capability, infrastructure, victim — assembled from tracked data; pivot from any vertex to the others.

Adversary5

Who is behind the activity — operator vs. customer.

Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffLazarus GroupAPT38BlueNoroffBluenoroff

Capability99

Tradecraft, techniques, and tooling the adversary employs.

99 ATT&CK techniquesStealthCommand and ControlDiscoveryExecution

Infrastructure

Physical/logical infrastructure used to deliver capability (C2, domains, relays).

No infrastructure indicators correlated in Radar yet.

Victim2

Targeting — sectors and geographies in scope.

Cryptocurrency / virtual asset exchangeUAE

Social-political (intent)Dual-purpose: (1) financial gain / revenue generation for the sanctioned DPRK regime — bank heists, ATM cash-outs and large-scale cryptocurrency theft used to fund state programs including WMD/ballistic-missile development; and (2) state-directed objectives — espionage, and in some operations destructive/disruptive attacks (e.g. Sony 2014, WannaCry 2017). The financial subclusters (APT38, BlueNoroff, TraderTraitor) are primarily money-driven; the broader Lazarus umbrella also conducts espionage and sabotage.

Operator ↔ CustomerOperator executes for direct financial benefit (operator ≈ customer).

Honesty note

Useful?

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

TechniqueT1078co-mentioned in 1 item
TechniqueT1190co-mentioned in 1 item
SectorCryptocurrencyco-mentioned in 1 item
MalwareZshBucketco-mentioned in 1 item
SectorBlockchainco-mentioned in 1 item
CVECVE-2026-31431co-mentioned in 1 item
TechniqueT1195.001co-mentioned in 1 item
SectorTechnologyco-mentioned in 1 item
TechniqueT1068co-mentioned in 1 item
SectorSoftware Developmentco-mentioned in 1 item
TechniqueT1195co-mentioned in 1 item

Kill Chain · Attack Flow

↓ STIX Attack Flow

The actor's techniques grouped into kill-chain phases — a partial order across phases; techniques within a phase are co-occurring, not sequenced. Export opens in CTID's Attack Flow Builder.

99 techniques across 7 of 7 stages · 6 of 6 pre-objective stages show known tradecraft — each a chance to break the chain before Actions on Objectives.

1Reconnaissance2

T1589.002T1591

2Weaponization8

T1588.004T1588.002T1587.001T1583.006T1584.004T1583.001T1585.001T1585.002

3Delivery5

T1566.001T1566.003T1195.002T1566.002T1189

4Exploitation9

T1106T1059.003T1059.005T1053.005T1047T1059.001T1203T1204.002+1

5Installation31

T1027T1686.003T1685T1553.002T1547.009T1098T1543.003T1547.001+23

6Command & Control11

T1090.001T1008T1071.001T1105T1104T1001.003T1090.002T1102.002+3

7Actions on Objectives33

T1074.001T1560T1056.001T1560.002T1005T1560.003T1555.003T1110.003+25

Honesty note

Phase groupings reflect ATT&CK tactic classification, not a confirmed operational timeline for Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff — see the competing-hypotheses breakdown for how confident this attribution really is.

See the analysis →

Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff

Diamond Model

Kill Chain · Attack Flow

Analysis of Competing Hypotheses