Signalis
sign in--:--:--UTC
Threat actors

Lazarus Group

☆ pin
MITRE G0009Also known as LABYRINTH CHOLLIMA, Labyrinth Chollima, APT38, Guardians of Peace, Bureau 121, Andariel, Moonstone Sleet, Lazarus Group
Reports
14
First seen
Mar 31, 2023
Last seen
Aug 13, 2026
Motivation
Espionage, Financial

Relationships

CVE-2026-68820, in 3 of Lazarus Group's reports, exploited in the wild×3CVE-2026-68820CVE-2016-4437, in 1 of Lazarus Group's report, exploited in the wildCVE-2016-4437CVE-2021-26855, in 1 of Lazarus Group's report, exploited in the wildCVE-2021-26855CVE-2021-27076, in 1 of Lazarus Group's report, exploited in the wildCVE-2021-27076Co-mentioned with Lazarus Group in 3 Signalis reports (co-mention, not confirmed collaboration)×3gunraReports targeting OtherOtherReports targeting GovernmentGovernmentReports targeting DefenseDefenseLazarus Group

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×2Government ×2Defense ×1Financial Services ×1Technology ×1
Victim regions
South Korea ×1

Top ATT&CK techniques

T1566 Phishing ×10T1190 Exploit Public-Facing Application ×7T1486 Data Encrypted for Impact ×6T1204 User Execution ×4T1547 Boot or Logon Autostart Execution ×4T1078 Valid Accounts ×4T1005 Data from Local System ×3T1583 Acquire Infrastructure ×3T1070.001 Indicator Removal: Clear Windows Event Logs ×3T1041 Exfiltration Over C2 Channel ×3T1195 Supply Chain Compromise ×3T1598 Phishing for Information ×3

Indicators

cve ×30domain ×11ip_v4 ×9filename ×8ethereum_address ×3

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-68820 (exploited)CVE-2021-26829 (exploited)CVE-2021-26855 (exploited)CVE-2021-27076 (exploited)CVE-2021-27137 (exploited)CVE-2021-36260 (exploited)CVE-2022-27925 (exploited)CVE-2022-40684 (exploited)CVE-2022-41082 (exploited)CVE-2023-20198 (exploited)CVE-2023-32315 (exploited)CVE-2023-46747 (exploited)CVE-2024-21762 (exploited)CVE-2024-36401 (exploited)CVE-2016-4437 (exploited)CVE-2025-24472 (exploited)CVE-2025-27915 (exploited)CVE-2025-37899CVE-2025-41244 (exploited)CVE-2025-49113 (exploited)

Recent reports

High

North Korean Remote Workers Infiltrating Government and Businesses: Detection and Prevention

The Hacker NewsCritical

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The Hacker NewsHigh

Microsoft Patch Tuesday: 419 vulnerabilities in August as AI accelerates bug discovery

The Record (Recorded Future News)High

CISA orders federal agencies to patch Windows vulnerability exploited by North Korean hackers in job-targeting campaign

The Record (Recorded Future News)Critical

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

The Hacker NewsHigh

U.S. and South Korean agencies warn of Gunra ransomware-as-a-service gang targeting critical infrastructure

CyberScoopCritical

Lazarus Group sharing cyberattack tools with Gunra ransomware operators targeting South Korea

The Record (Recorded Future News)High

June 2026 CVE Landscape: 60 High-Impact Vulnerabilities Actively Exploited

Recorded Future InsiktHigh

CrowdStrike 2026 Technology Threat Landscape Report: China's Ambitions Fuel Attacks

CrowdStrike BlogHigh

Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms

The Hacker NewsHigh

The Evolving Linux Threat Landscape

Huntress BlogMedium

Why LinkedIn is a hunting ground for threat actors – and how to protect yourself

ESET WeLiveSecurityHigh

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat IntelHigh

3CX Supply Chain Compromise: Contextualizing Events and Enabling Defense

Huntress Blog

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans