AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Lazarus Group
Aliases: Diamond Sleet, Guardians of Peace, HIDDEN COBRA, Labyrinth Chollima, Lazarus Group, NICKEL ACADEMY, ZINC
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)
Open interactive actor investigation
ATT&CK techniques
T1001.003T1005T1008T1010T1012T1016T1021.001T1021.002T1021.004T1027.007T1027.009T1027.013T1033T1036.003T1036.004T1036.005T1041T1046T1047T1048.003T1049T1053.005T1055.001T1056.001T1057T1059.001T1059.003T1059.005T1070T1070.003T1070.004T1070.006T1071.001T1074.001T1078T1082T1083T1090.001T1090.002T1098T1102.002T1104T1105T1106T1110.003T1124T1132.001T1134.002T1140T1189T1202T1203T1204.002T1218T1218.005T1218.011T1485T1489T1491.001T1529T1542.003T1543.003T1547.001T1547.009T1553.002T1557.001T1560T1560.002T1560.003T1561.001T1561.002T1564.001T1566.001T1566.002T1566.003T1571T1573.001T1574.001T1574.013T1583.001T1583.006T1584.004T1585.001T1585.002T1587.001T1588.002T1588.004T1589.002T1591T1620T1680T1685T1686.003
Correlated CTI and IR reports
Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution
1200km CTI repository · explicit report mentionCTI Research: Kubernetes & Cloud-Native Threat Landscape
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionCTI Research Kubernetes Cloud Native Threat Landscape
1200km Medium · authored report mentionComprehensive Guide to DoS and DDoS Attacks with MITRE ATT CK
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionPhishing Email Awareness Protecting Employees and Organizations
1200km Medium · authored report mention
1200km CTI repository · explicit report mentionCTI Research: Kubernetes & Cloud-Native Threat Landscape
1200km CTI repository · explicit report mentionFrom Threat Intelligence to Detection: A Practitioner's Guide
1200km CTI repository · explicit report mentionCTI Research Kubernetes Cloud Native Threat Landscape
1200km Medium · authored report mentionComprehensive Guide to DoS and DDoS Attacks with MITRE ATT CK
1200km Medium · authored report mentionFrom Threat Intelligence to Detection A Practitioner s Guide
1200km Medium · authored report mentionPhishing Email Awareness Protecting Employees and Organizations
1200km Medium · authored report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- route tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netsh tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Responder tool reference — Explicit actor uses software relationship in pinned ATT&CK
- RawDisk tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1001.003 Protocol or Service Impersonation simulation — Exact active technique ID
- T1001.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1008 Fallback Channels simulation — Exact active technique ID
- T1008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1010 Application Window Discovery simulation — Exact active technique ID
- T1010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.007 Dynamic API Resolution simulation — Exact active technique ID
- T1027.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.009 Embedded Payloads simulation — Exact active technique ID
- T1027.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.003 Rename Legitimate Utilities simulation — Exact active technique ID
- T1036.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol simulation — Exact active technique ID
- T1048.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.001 Dynamic-link Library Injection simulation — Exact active technique ID
- T1055.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070 Indicator Removal simulation — Exact active technique ID
- T1070 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.003 Clear Command History simulation — Exact active technique ID
- T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.001 Internal Proxy simulation — Exact active technique ID
- T1090.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098 Account Manipulation simulation — Exact active technique ID
- T1098 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.002 Bidirectional Communication simulation — Exact active technique ID
- T1102.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1104 Multi-Stage Channels simulation — Exact active technique ID
- T1104 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.003 Password Spraying simulation — Exact active technique ID
- T1110.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1134.002 Create Process with Token simulation — Exact active technique ID
- T1134.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1202 Indirect Command Execution simulation — Exact active technique ID
- T1202 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218 System Binary Proxy Execution simulation — Exact active technique ID
- T1218 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.005 Mshta simulation — Exact active technique ID
- T1218.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1489 Service Stop simulation — Exact active technique ID
- T1489 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1491.001 Internal Defacement simulation — Exact active technique ID
- T1491.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1529 System Shutdown/Reboot simulation — Exact active technique ID
- T1529 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1542.003 Bootkit simulation — Exact active technique ID
- T1542.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.009 Shortcut Modification simulation — Exact active technique ID
- T1547.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1557.001 Name Resolution Poisoning and SMB Relay simulation — Exact active technique ID
- T1557.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.002 Archive via Library simulation — Exact active technique ID
- T1560.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.003 Archive via Custom Method simulation — Exact active technique ID
- T1560.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.001 Disk Content Wipe simulation — Exact active technique ID
- T1561.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.002 Disk Structure Wipe simulation — Exact active technique ID
- T1561.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.001 Hidden Files and Directories simulation — Exact active technique ID
- T1564.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.003 Spearphishing via Service simulation — Exact active technique ID
- T1566.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.013 KernelCallbackTable simulation — Exact active technique ID
- T1574.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.004 Server simulation — Exact active technique ID
- T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.004 Digital Certificates simulation — Exact active technique ID
- T1588.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.002 Email Addresses simulation — Exact active technique ID
- T1589.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591 Gather Victim Org Information simulation — Exact active technique ID
- T1591 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1620 Reflective Code Loading simulation — Exact active technique ID
- T1620 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1680 Local Storage Discovery simulation — Exact active technique ID
- T1680 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686.003 Windows Host Firewall simulation — Exact active technique ID
- T1686.003 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Actor-name and alias discipline; this route does not assert successful theft of Pfizer vaccine research. Evidence cutoff: 2026-09-25.