Lazarus Group
MITRE G0009Also known as Labyrinth Chollima, LABYRINTH CHOLLIMA, APT38, Guardians of Peace, Bureau 121, North Korean threat actor, Andariel, Moonstone Sleet, Lazarus Group
Reports
18
First seen
Mar 31, 2023
Last seen
Oct 8, 2026
Motivation
Espionage, Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Victim regions
×1×1
South Korea×1
Singapore×1
Japan×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×13T1190 Exploit Public-Facing Application ×11T1486 Data Encrypted for Impact ×7T1078 Valid Accounts ×6T1041 Exfiltration Over C2 Channel ×5T1547 Boot or Logon Autostart Execution ×5T1204 User Execution ×4T1555 Credentials from Password Stores ×4T1005 Data from Local System ×3T1567 Exfiltration Over Web Service ×3T1583 Acquire Infrastructure ×3T1219 Remote Access Software ×3
Indicators
cve ×66domain ×11filename ×10ip_v4 ×9ethereum_address ×3
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-68820 (exploited)CVE-2021-26855 (exploited)CVE-2024-36401 (exploited)CVE-2021-27137 (exploited)CVE-2021-36260 (exploited)CVE-2022-1388 (exploited)CVE-2022-27925 (exploited)CVE-2022-40684 (exploited)CVE-2022-41082 (exploited)CVE-2023-20198 (exploited)CVE-2023-32315 (exploited)CVE-2023-46747 (exploited)CVE-2024-21762 (exploited)CVE-2024-24919 (exploited)CVE-2021-27076 (exploited)CVE-2024-5559 (exploited)CVE-2025-24472 (exploited)CVE-2025-27915 (exploited)CVE-2025-37899CVE-2021-26829 (exploited)
Recent reports
unrated