Lazarus Group
A North Korean name that covers several overlapping operators. The NCSC assessed it was highly likely that Lazarus Group was behind WannaCry, which hit 48 NHS trusts. The FBI uses TraderTraitor for North Korean cryptocurrency theft, including the theft of more than $6 billion from Binance in October 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The clearest UK example is WannaCry. In December 2017 the Foreign Office minister said the NCSC assessed it was highly likely that North Korean actors known as the Lazarus Group were behind the campaign. The UK government said it affected 300,000 computers in 150 countries, including 48 NHS trusts.5 In October 2025 the UK joined ten other countries in a statement saying North Korea's cyber activity includes cryptocurrency theft, fraudulent IT work and cyber espionage.4
Be careful with the name. MITRE warns that public reporting often uses Lazarus Group as an umbrella term for several North Korean operators, whose units share people, infrastructure and malware, which makes specific attribution difficult.1 The FBI's public statements on Bybit and Binance use TraderTraitor.6,7 Some attributions also differ: ESET places the 2026 axios npm compromise within Lazarus, while Google attributes it to a North Korean actor it calls UNC1069.9,10
This is not only a cryptocurrency firm's problem. ESET attributes a campaign against European defence and drone-related manufacturers to Lazarus with high confidence, and links the same malware to an October 2023 attack on a British industrial automation company.8 TraderTraitor intrusions also reached a wallet software provider through a developer's workstation, showing how one engineer's machine can open a route into a supplier.3
The pattern across these reports is a personal approach to a person with privileged technical access. Developer and DevOps laptops look like an underrated route, so treat them as high-value systems.
How It Attacks
This combines government advisories with reports from Wiz, ESET and Binance's own statement.2,3,8,11 Different North Korean operators use different parts of it.
- 1
Approach a Person
Poses as a recruiter on platforms such as LinkedIn, Slack, Telegram or GitHub, often targeting developers, DevOps and IT staff.
- 2
Get Code Run
Offers a coding challenge, a trading tool or a trojanised open source project. The US advisory describes trojanised cryptocurrency apps with fake update functions.
- 3
Steal Developer Secrets
Takes SSH keys, cloud configuration and session cookies from the developer's machine, according to Wiz.
- 4
Move Into Cloud or Supplier Systems
Uses stolen session tokens to bypass MFA, explores cloud roles and storage, tries to register virtual MFA devices and may tamper with a supplier's web front end.
- 5
Reach the Target Process
At Binance, the company says a compromised laptop gave access to a service container in the withdrawal process, where unauthorised withdrawals were submitted.
- 6
Steal and Launder
Takes cryptocurrency and moves it quickly. The FBI said Binance funds were being converted mainly into Ether and expects DeFi and instant swap services to be used.
Key Techniques
Selected from the Lazarus Group ATT&CK v20 entry.1 These do not all apply to TraderTraitor, which has no separate ATT&CK entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566.003 | Spearphishing via Service | Initial Access | Sends spearphishing messages through platforms including LinkedIn. |
| T1585.001 | Social Media Accounts | Resource Development | Creates social media accounts to engage potential victims. |
| T1204.002 | Malicious File | Execution | Gets users to open a malicious attachment. |
| T1583.006 | Web Services | Resource Development | Has hosted malicious downloads on GitHub. |
| T1574.001 | DLL | Stealth | Replaced a DLL in a software installation to load malware. |
| T1036.005 | Match Legitimate Resource Name or Location | Stealth | Renames malicious code to look like legitimate files. |
| T1090.002 | External Proxy | Command and Control | Uses multiple proxies to obscure network traffic. |
| T1041 | Exfiltration Over C2 Channel | Exfiltration | Sends stolen data over its command and control channel. |
| T1485 | Data Destruction | Impact | Overwrites file contents to destroy data. |
| T1561.002 | Disk Structure Wipe | Impact | Has overwritten and deleted the master boot record. |
Tools Observed
Listed for Lazarus Group
Reported for TraderTraitor
Reported in Operation DreamJob
Lists come from ATT&CK, the 2022 advisory, Wiz and ESET.1,2,3,8 ATT&CK also tracks AppleJeus as a separate group entry, which shows how blurred these North Korean labels are.
Vulnerabilities
Software flaws are not the main story in these sources, which focus on social engineering. ATT&CK records this one for Lazarus Group:1
No source reviewed for this profile ties a specific CVE to the Binance theft.
Key Events
Active from at least this year, according to ATT&CK.1
WannaCry spreads globally and affects 48 NHS trusts.5
The UK publicly attributes WannaCry, based on the NCSC's assessment.5
The FBI, CISA and US Treasury publish their TraderTraitor advisory.2
About $308 million is stolen from DMM Bitcoin in May. In December, Japan's police, the FBI and DC3 attribute it to TraderTraitor.13
The FBI says North Korea stole about $1.5 billion from Bybit, naming TraderTraitor.6
ESET reports Lazarus targeting European defence and drone-related firms. The UK and ten partners issue a statement on North Korean cyber activity.8,4
ESET reports continued Lazarus activity, including Operation DreamJob.9
The FBI attributes the theft of more than $6 billion from Binance to North Korea, naming TraderTraitor.7 North Korea denies it.14
Warning Signs
Drawn from the 2022 advisory and Wiz's analysis.2,3 None of these proves an attack alone, but each deserves a quick check.
- A recruiter approach to an engineer that leads to downloading a tool or running a coding test
- An unfamiliar cryptocurrency trading or price prediction application on a work device
- A new virtual MFA device registered on a cloud account
- Cloud key misuse, or role and storage enumeration from a developer's identity
- Unexpected packages in shared code repositories
- Unexpected changes to a statically hosted web front end
Defences That Matter
Protect Developers and Engineers
- Warn privileged technical staff about recruiter lures and coding tests.2,3
- Limit developers' permissions, especially in production and CI/CD.3
- Download cryptocurrency applications only from primary sources.2
Remove Single Points of Failure
- Make sure one endpoint or identity cannot authorise a high-value transfer.11
- Segment networks and identities so one workstation cannot reach sensitive resources.3
Watch Identities and Secrets
- Use MFA and monitor for anomalous logins.2
- Scan for exposed secrets, and alert on cloud key misuse and new MFA registrations.3
Vet the Supply Chain
- Track code dependencies for suspicious packages.3
- Assess the access that key suppliers and software providers have to your systems.
Could a Fake Job Offer Reach Your Engineers?
We can test how your technical staff and privileged access hold up against the methods in this profile, then help you close the gaps.
Sources
- MITRE ATT&CK: Lazarus Group (G0032), ATT&CK v20
- FBI, CISA and US Treasury: advisory AA22-108A, TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, 18 April 2022
- Wiz Research: TraderTraitor: Deep Dive, 28 July 2025
- GOV.UK: Joint statement of the Multilateral Sanctions Monitoring Team on the report covering DPRK cyber and IT worker activities, 22 October 2025
- GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks, 19 December 2017
- FBI: PSA I-022625-PSA on the $1.5 billion Bybit theft, 26 February 2025
- TechRadar: FBI confirms it thinks North Korean hackers hit Binance in record cryptocurrency heist, 2 November 2026
- ESET Research: Gotta fly: Lazarus targets the UAV sector, 23 October 2025
- ESET: APT Activity Report Q4 2025 to Q1 2026, 28 May 2026
- The Record: Google links axios supply chain attack to North Korea, 31 March 2026
- CSO Online: A compromised DevOps laptop caused the $6.3B Binance breach, 2 November 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- Japan National Police Agency: statement with the FBI and DC3 on the theft from DMM Bitcoin, December 2024
- CoinDesk: North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor, 3 November 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.