North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean hackers steal billions of dollars, exfiltrate military technologies, surveil politicians and journalists, and sometimes secure programming jobs at foreign companies under false identities. These operations are conducted by specialized groups, many working on behalf of North Korean intelligence and state structures.
How North Korea’s Hacker Ecosystem Is Organized
A significant portion of overseas cyber operations is attributed to the Reconnaissance General Bureau (RGB). Open sources also mention Bureau 121, Lab 110, and other units. Separate operations are linked to the Ministry of State Security and structures of the Workers’ Party of Korea. No complete organizational chart is publicly available.
Researchers assign names based on tools, servers, intrusion methods, and victim selection. Microsoft uses designations such as Diamond Sleet and Emerald Sleet, while CrowdStrike prefers names ending in Chollima. In July 2026 Google began transitioning to a new taxonomy in which North Korean groups receive names containing NEPTUNE.
Lazarus Group and Its Subdivisions
Lazarus Group specializes in cyber espionage, financial crime, destructive attacks, and technology theft. The group is linked to the 2014 destruction of Sony Pictures data, the theft of $81 million from the Bangladesh central bank in 2016, and the 2017 distribution of WannaCry. Lazarus is also connected to numerous operations against banks and cryptocurrency organizations.
Labyrinth Chollima and Diamond Sleet focus on strategic espionage targeting defense technologies, industry, telecommunications, and critical infrastructure. In January 2026 CrowdStrike split the former Labyrinth Chollima into three tracks: the main cluster retained the name, while the financial tracks were named Golden Chollima and Pressure Chollima.
UNC2970 steals defense, aerospace, and energy research through fake job offers. The group studies victims’ professional backgrounds and sends malicious files disguised as legitimate job materials, including a modified version of SumatraPDF.
Financial Crime Clusters
APT38 and BeagleBoyz have conducted bank heists and attacks on payment systems since at least 2014, including the Bangladesh Bank operation and the FASTCash scheme that manipulated ATM withdrawal approvals.
BlueNoroff, also tracked as Sapphire Sleet and Midnight Neptune, specializes in cryptocurrency theft from investment funds, exchanges, and financial-application developers. Operators pose as investors or business partners and trick victims into installing malicious trading applications.
Pressure Chollima and TraderTraitor were linked to the February 2025 theft of approximately $1.5 billion from Bybit and the October 2026 theft of roughly $6.36 billion from Binance. Both incidents involved compromise of developer infrastructure and transaction-signing mechanisms.
Political and Military Espionage Groups
Kimsuky and APT43 target diplomats, journalists, researchers, and think tanks, focusing on U.S. and South Korean policy toward Pyongyang. The group frequently impersonates journalists to build trust with victims.
APT37 (also known as ScarCruft) primarily targets South Korea and other Asian countries, monitoring defectors and human-rights activists. In May 2026 the group was found compromising a gaming platform used by ethnic Koreans in China’s Yanbian region.
Andariel (also APT45) combines intelligence collection on nuclear and defense technologies with ransomware operations, including deployment of the Maui ransomware against U.S. healthcare organizations.
Fake IT Workers and Contagious Interviews
Famous Chollima and Jasper Sleet create fabricated résumés, pass interviews, and obtain remote developer positions at foreign companies, often using intermediaries to receive company laptops. Some operators work at multiple organizations simultaneously.
Contagious Interview operators pose as employers, sending malicious code samples or project tasks during recruitment processes. The campaign has distributed tools such as BeaverTail and OtterCookie through GitHub repositories and developer packages.
Related articles
China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike reported on 28 October 2026 that the China-linked group WARP PANDA used CVE-2026-41709, a zero-day in VMware ESX, to operate without leaving records on compromised hypervisors. The vulnerability carries a low CVSS 3.1 score of 2.7 and was added the same day to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 11 November. Broadcom describes the flaw as insufficient logging that allows a malicious administrator to execute certain operations without them appearing in logs. The issue does not enable remote code execution or privilege escalation on its own; its value lies in erasing the audit trail that incident responders rely on to reconstruct activity. CrowdStrike linked the exploitation to espionage operations against U.S. legal-sector organizations, with activity intensifying in early 2026. The report also highlights deployment of BRICKSTORM and SharpStorm malware in vCenter environments along with stolen cloud session tokens. Broadcom has released fixed builds for ESXi 9.1, 9.0.2 and 8.0 U3j, while VMware Cloud Foundation 5 requires version 5.2.4.
North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests
The North Korean-linked group WaterPlum, also known as Contagious Interview, has infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026. According to the Internet Crime Complaint Center (IC3), the operation moved at least $10.7 million in cryptocurrency to North Korea and compromised more than 7,000 wallets. Attackers pose as recruiters on social media and freelance platforms, luring software developers with nonexistent job offers that require downloading malicious files disguised as coding tests. The malware arsenal includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, with the latter hiding inside blockchain-themed projects and abusing Visual Studio Code configurations. Developers are specifically targeted because they often store production keys, wallets, and credentials on the same machines used for testing third-party code. Japanese authorities have dismantled laptop farms connected to the scheme that helped maintain the attackers' operational cover.
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.
APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations
The Russian-linked APT28 group, also known as BlueDelta, has deployed a new lightweight backdoor called HOOKEDGE as part of a cyber-espionage campaign against strategic European entities. The attacks, assessed with moderate confidence, targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Turkey between September 2025 and April 2026. Infection begins with spear-phishing emails delivering Microsoft Word documents containing malicious macros that mimic official Spanish government materials. Upon execution, the macros drop files, establish persistence via scheduled tasks, and deploy the HOOKEDGE backdoor written in batch scripts. The malware uses hidden Microsoft Edge instances and the legitimate webhook.site service to blend command-and-control traffic with normal web activity. In high-value victims, operators installed a second HOOKEDGE instance with five-minute check-ins for faster control and data collection. The backdoor shows strong code similarities to the older HEADLACE implant previously attributed to the same group.