Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff

Attributed by the U.S. Government (CISA/FBI/Treasury), Mandiant/FireEye, Kaspersky and others to the Democratic People's Republic of Korea (DPRK), specifically the Reconnaissance General Bureau (RGB) — the DPRK's primary foreign intelligence service (units commonly referenced as Bureau 121 / Lab 110). Attribution confidence: HIGH for state sponsorship and DPRK/RGB origin (corroborated by multiple government advisories, a DOJ indictment, and independent vendor telemetry). The internal cluster taxonomy is looser: 'Lazarus Group' is often used as an umbrella for all DPRK activity, while APT38 (MITRE G0082), BlueNoroff and TraderTraitor are financially-motivated subclusters that many vendors track separately; boundaries between them overlap and are drawn differently by different reporters (MEDIUM confidence on exact subcluster demarcation). MITRE tracks Lazarus as G0032 and APT38 as G0082, and folds BlueNoroff under APT38/G0082.

North Korea

2009 (Lazarus umbrella activity, e.g. Operation Troy DDoS attacks; financially-focused APT38 subcluster active since at least 2014)

2025 (FBI attribution of the ~$1.5B Bybit crypto heist to the TraderTraitor cluster, February 2025)

Dual-purpose: (1) financial gain / revenue generation for the sanctioned DPRK regime — bank heists, ATM cash-outs and large-scale cryptocurrency theft used to fund state programs including WMD/ballistic-missile development; and (2) state-directed objectives — espionage, and in some operations destructive/disruptive attacks (e.g. Sony 2014, WannaCry 2017). The financial subclusters (APT38, BlueNoroff, TraderTraitor) are primarily money-driven; the broader Lazarus umbrella also conducts espionage and sabotage.

high

UAE

Cryptocurrency / virtual asset exchange