Every other nation-state APT has a primary mission: espionage (APT29), destruction (Sandworm), or pre-positioning (Volt Typhoon). Lazarus does all of the above, plus financial crime at industrial scale. Their cryptocurrency operations directly fund North Korea's nuclear weapons program. The $1.5 billion Bybit heist (February 2025) was the largest cryptocurrency theft in history. The Bangladesh Bank SWIFT attack (2016) attempted to steal $951 million. They deployed WannaCry ransomware globally (2017). They run Maui ransomware against US healthcare (2022).

Lazarus operates through specialized subgroups. Bluenoroff (APT38) handles financial operations: SWIFT fraud, cryptocurrency exchange heists, DeFi exploits. Andariel handles espionage and ransomware, primarily targeting South Korean defense and critical infrastructure. The parent Lazarus umbrella conducts destructive operations and high-profile attacks (Sony Pictures 2014, WannaCry 2017). These subgroups share tooling and infrastructure but have distinct targeting and mission sets.

Bybit ($1.5B, February 2025): Compromised Safe{Wallet} multi-signature platform to manipulate transaction approvals. Laundered through THORChain within hours. FBI attribution within five days. The single largest crypto theft in history.
Ronin Bridge ($620M, March 2022): Compromised validator keys for the Axie Infinity Ronin Bridge via social engineering of Sky Mavis employees through fake LinkedIn job offers.
Bangladesh Bank ($81M stolen of $951M attempted, 2016): Infiltrated Bangladesh Central Bank's SWIFT terminal, submitted 35 fraudulent transfer requests. A typo in one request triggered scrutiny that stopped most transfers.
Sony Pictures (2014): Destructive wiper attack in retaliation for "The Interview" film. Exfiltrated and leaked unreleased films, emails, and employee data.
WannaCry (2017): Global ransomware leveraging EternalBlue. 200,000+ systems across 150 countries. Linked to Lazarus via code similarities with earlier DPRK tooling.
Maui ransomware (2022): Targeting US healthcare organizations. FBI/CISA joint advisory. Manual deployment (not spray-and-pray), with specific targeting of healthcare for maximum payment pressure.

1. 1. Check for trojanized developer tools and packages Search developer workstations for: recently installed npm/PyPI packages from unknown publishers, Node.js or Python processes making outbound connections to unusual IPs, and coding assessment files received via LinkedIn/Telegram from "recruiters." Operation DreamJob specifically targets developers with fake job offers containing malicious code samples. HOST: Execution · npm audit · pip audit
2. 2. Audit cryptocurrency wallet infrastructure If you operate cryptocurrency infrastructure: review multi-sig approval workflows, audit smart contract permissions, check for unauthorized API key creation, and verify that hardware wallet firmware is genuine. Lazarus targets the transaction signing process, not the blockchain itself. Application-specific audit logs · Smart contract event monitoring
3. 3. Hunt for DLL side-loading Lazarus heavily uses DLL side-loading via legitimate signed executables (documented: Bitdefender, VMware, and other vendor binaries loading malicious DLLs). Search for: signed executables in non-standard paths loading DLLs from the same directory, and known side-loading pairs in Sysmon EID 7 (ImageLoad). HOST: Defense Evasion · Sysmon EID 7 · HOST: Persistence
4. 4. Check for social engineering via LinkedIn and Telegram Lazarus runs persistent social engineering campaigns posing as recruiters from major tech companies. Review: unsolicited job offers received by developers, especially those including coding tests, archive files, or links to private GitHub repos. The "recruiter" profiles are well-crafted with stolen photos and fabricated work histories.
5. 5. Search for SWIFT terminal access anomalies If you operate banking/financial infrastructure: audit SWIFT Alliance Lite2 terminal access logs, check for unauthorized message submissions, and verify that SWIFT operator credentials haven't been compromised. Lazarus specifically targets the SWIFT messaging interface for fraudulent transfer requests.
6. 6. Check for credential harvesting and lateral movement Standard post-compromise: LSASS dumping, SAM extraction, Kerberoasting. Lazarus performs aggressive credential harvesting early in the intrusion to move toward high-value financial systems. The credential chain leads to their actual target (SWIFT terminals, wallet infrastructure, financial databases). HOST: T1003.001 LSASS · HOST: Lateral Movement
7. 7. Look for cross-platform implants Lazarus operates across Windows, macOS, Linux, and mobile (Android). AppleJeus targets macOS alongside Windows. Check non-Windows endpoints that are often overlooked in hunts: developer MacBooks, Linux build servers, and mobile devices with access to cryptocurrency wallets. HOST: Persistence (Linux techniques) · macOS: launchd persistence
8. 8. Monitor for data exfiltration and financial staging Lazarus exfiltrates both data (for espionage) and money (for revenue). Financial staging indicators: unusual cryptocurrency transactions, unauthorized API calls to exchange platforms, and large transfers to new wallet addresses. Data exfiltration: archive creation, cloud storage uploads, and C2-based file transfer. NET: Exfiltration · C2
9. 9. Check for Maui ransomware indicators (healthcare sector) If you're in healthcare: Maui is manually deployed (not spray-and-pray). Look for: new executables in admin-accessible paths, AES-encrypted files with .maui extension, ransom notes referencing "Maui," and the manual nature of the deployment (single hosts encrypted in sequence, not domain-wide GPO push). Ransomware playbook · HOST: T1486
10. 10. Assess whether the compromise is espionage or financial The response differs. Espionage (Andariel): focus on what data was accessed, how long they had access, and what persistence they left. Financial (Bluenoroff): focus on stopping the money, recalling transfers, and freezing wallets. Time is money, literally: Lazarus launders cryptocurrency within hours of theft. ATTRIB engine · FBI IC3 for financial reporting

Financial motivation at nation-state scale. No other APT steals money. Lazarus funds a nuclear weapons program through cryptocurrency theft. This creates urgency: every dollar stolen is a dollar that funds weapons proliferation. Financial institutions and cryptocurrency platforms are legitimate national security targets for DPRK.

Developer targeting. Operation DreamJob and Operation 99 specifically target individual developers through social engineering. The attack surface isn't a server or a network: it's a person's LinkedIn inbox. This is fundamentally different from the infrastructure-targeting approach of every other actor in this playbook collection.

Cross-platform parity. Most APTs are Windows-primary with limited Linux capability. Lazarus operates with equal fluency across Windows, macOS, Linux, and mobile. Their AppleJeus trojanized trading apps target macOS specifically because cryptocurrency developers disproportionately use Macs.

Planted insiders (FAMOUS CHOLLIMA). DPRK-linked operatives use AI-generated resumes, deepfake interviews, and fabricated identities to get hired at Western companies through legitimate recruiting processes. Activity more than doubled in 2025 (CrowdStrike 2026 GTR). This is not credential theft or social engineering: it is placing intelligence operatives inside target organizations with real badges and real access. See the Insider Threat playbook for detection guidance.

Supply chain precision (Bybit). PRESSURE CHOLLIMA's $1.46B Bybit theft (CrowdStrike 2026 GTR) was executed by compromising the Safe{Wallet} platform, inserting malicious JavaScript and smart contract logic into trusted financial software, executing the theft, then reverting the code changes to cover their tracks. The supply chain was the access. The code revert was the anti-forensics.

Ransomware Detected (Maui ransomware against healthcare)
C2 Beacon Found (FALLCHILL, CookiePlus, and custom implant detection)
Compromised Credentials (credential theft chain toward financial systems)