Lazarus Group

Lazarus Group is an umbrella attribution and sanctions label used for North Korean cyber actors associated with the Reconnaissance General Bureau. United States authorities have linked the label to disruptive attacks, bank theft, cryptocurrency theft and money laundering. The exact organisational boundaries and mapping of particular operations remain partly contested.

Identity and state nexus

The United States Treasury designated Lazarus Group, Bluenoroff and Andariel on 13 September 2019 and described their relationships to the Reconnaissance General Bureau (Treasury, 2019). This is an administrative attribution and sanctions record. It does not establish that Lazarus Group is one incorporated body, headquarters or operational unit responsible for every campaign associated with the wider North Korean cyber ecosystem.

The Multilateral Sanctions Monitoring Team used Lazarus Group more narrowly in its October 2025 report, covering four clusters associated with the 110 Research Institute: Temp.Hermit, Citrine Sleet, TraderTraitor and CryptoCore. Its definition differs from broader public usage. Labels therefore require a source and date; they are not automatically interchangeable (MSMT, 2025, p. 15, note 18).

The United States state-nexus assessment is direct, while operation-to-cluster mapping varies. A 2021 joint advisory by the Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation and Treasury attributes specified AppleJeus cryptocurrency malware activity and documents observed techniques (AA21-048A). Technical indicators, vendor clustering, government attribution and judicial process remain separate evidence layers.

Operations and revenue generation

The public record traces a progression from disruptive attacks to bank and cryptocurrency theft. The 2021 United States indictment alleges that three named North Korean military hackers participated in a wide range of cyberattacks and financial crimes, including the Bangladesh Bank operation (Department of Justice, 17 February 2021; indictment). The indictment records allegations, not findings of guilt.

For Bangladesh Bank, attempted transfer instructions, funds transferred, recoveries and final loss are different figures. The indictment alleges attempted instructions of approximately USD 951 million, separately identifying approximately USD 81 million transferred to Philippine accounts and USD 20 million to a Sri Lankan account. Those transfer figures are not a calculation of final unrecovered loss (indictment, overt act 6, p. 17). Other incidents, including Sony Pictures, WannaCry and the Ronin bridge theft, also require their own attribution, amount and legal-status records.

On 26 February 2025, the Federal Bureau of Investigation attributed the theft of approximately USD 1.5 billion from Bybit on or about 21 February to the Democratic People's Republic of Korea and identified the activity as TraderTraitor (FBI, 2025). This does not make TraderTraitor identical to every actor described as Lazarus Group. Claims that a theft was the largest ever require a defined dataset and comparison date.

Statecraft relevance and response

Cyber theft functions as state-directed revenue generation and sanctions adaptation where state direction and revenue purpose are established. Sanctions pressure does not alter the criminal character of the conduct. In May 2022, the Office of Foreign Assets Control added identified virtual-currency addresses to its Lazarus Group record (OFAC, 6 May 2022). Address designation, attribution and proof of ownership remain distinct.

The Multilateral Sanctions Monitoring Team reported in October 2025 on North Korean sanctions violations and evasion through cyber and information-technology worker activity (MSMT Report No. 2). Japan's 22 October 2025 release notice described the MSMT as a separate eleven-state mechanism established after the former United Nations Panel of Experts ended. Treasury's 8 July 2025 action supplies a dated United States description of named information-technology worker revenue networks and their alleged Reconnaissance General Bureau relationship. Government assessments that stolen funds support prohibited programmes should not be converted into transaction-level proof of the end use of every stolen asset.

See also

North Korean cryptocurrency theft campaign (2017-present) · Bangladesh Bank heist (2016) · North Korea · Cryptocurrency and stablecoin sanctions evasion · Cryptocurrency mixers and tumblers (Tornado Cash, Blender.io) · Blockchain analytics platforms (Chainalysis, Elliptic, TRM) · Offensive cyber tools against financial infrastructure · SWIFT · Economic statecraft

Sources

• United States Department of the Treasury, Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups (13 September 2019).
• United States Department of Justice, Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe (17 February 2021).
• United States v Jon Chang Hyok, Kim Il and Park Jin Hyok, Indictment, No. 2:20-cr-00614 (Central District of California, filed 8 December 2020, unsealed 17 February 2021).
• Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation and United States Department of the Treasury, AppleJeus: Analysis of North Korea's Cryptocurrency Malware, AA21-048A (17 February 2021).
• Office of Foreign Assets Control, Cyber-related Designation; North Korea Designation Update (6 May 2022).
• Federal Bureau of Investigation, North Korea Responsible for USD 1.5 Billion Bybit Hack (26 February 2025).
• Multilateral Sanctions Monitoring Team, The DPRK's Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities, Report No. 2 (22 October 2025).
• United States Department of the Treasury, Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime (8 July 2025).
• Ministry of Foreign Affairs of Japan, Release of the Second Report of the Multilateral Sanctions Monitoring Team (MSMT) (22 October 2025).