Lazarus Group 2026 Tracker: Every Victim, Every Method

A North Korean state hacking umbrella operating under the Reconnaissance General Bureau. Three named subgroups. Multi-billion-dollar bank and crypto heists since 2015. The February 2025 Bybit theft was the largest on record.

State of Surveillance

TL;DR: Lazarus Group is the umbrella name for a set of North Korean state-sponsored hacking teams that operate under the country's Reconnaissance General Bureau (RGB), per CISA's AA24-207A advisory.[1] Different CISA and FBI advisories cover different subgroups: TraderTraitor (aka APT38, BlueNoroff, Stardust Chollima) for cryptocurrency theft[2]; BeagleBoyz (overlapping with Lazarus, APT38, Bluenoroff, Stardust Chollima) for bank heists and FASTCash ATM cash-outs[3]; and Andariel / Onyx Sleet (formerly PLUTONIUM, also tracked as DarkSeoul, Silent Chollima, Stonefly/Clasiopa) for defense, aerospace, nuclear and engineering espionage.[1] CISA's AA20-239A puts attempted thefts from these teams at "nearly $2 billion since at least 2015" across at least 38 countries[3]. The February 26, 2025 FBI PSA (I-022625-PSA) attributed the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange Bybit to North Korean TraderTraitor actors, with the theft itself dated on or about February 21, 2025; the PSA lists the Ethereum addresses holding or having held assets from the theft and asks RPC node operators, exchanges, bridges, DeFi services and blockchain analytics firms to block them.[4] Treasury sanctioned cryptocurrency mixer Tornado Cash on August 8, 2022, citing "over $455 million" laundered for the Lazarus Group.[5] This page covers the operations documented in CISA, FBI, and Treasury advisories through 2025.

What Lazarus Group Actually Is

Lazarus Group is not a single crew of hackers. It is a public-facing name that the cybersecurity industry and parts of the U.S. government use for multiple DPRK state-sponsored teams operating under the Reconnaissance General Bureau, North Korea's primary foreign intelligence service. CISA's AA24-207A advisory, released July 25, 2024 and updated August 6, 2024, attributes a global espionage campaign to the RGB 3rd Bureau, "based in Pyongyang and Sinuiju," and lists the tracked names as "Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa."[1]

The crypto-theft side of the same apparatus is described in CISA's AA22-108A advisory (April 18, 2022; last revised April 20, 2022). It identifies "a North Korean state-sponsored advanced persistent threat" and says the group "is commonly tracked by the cybersecurity industry as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima."[2] Treasury's August 8, 2022 Tornado Cash press release calls Lazarus Group a "Democratic People's Republic of Korea (DPRK) state-sponsored hacking group that was sanctioned by the U.S. in 2019" and links it to "the largest known virtual currency heist to date" at the time.[5]

The bank-heist side runs under the operational name BeagleBoyz. CISA's AA20-239A advisory (August 26, 2020) attributes FASTCash ATM cash-outs and fraudulent SWIFT abuse to "the Reconnaissance General Bureau-linked North Korean hacking team dubbed 'BeagleBoyz,' overlapping with industry-tracked groups Lazarus, APT38, Bluenoroff, and Stardust Chollima."[3] So depending on which vector you read about, the actor name shifts: Lazarus Group is the umbrella, the subgroups are the operators.

Known Victims

This list covers publicly reported victims confirmed by the FBI, CISA, Treasury, or the victims themselves. Lazarus Group's own leak-site claims do not appear in CISA advisories; every victim below is sourced to a U.S. government or victim statement.

Bank of Bangladesh and the SWIFT Heist (February 2016)

The single most consequential bank heist attributed to the BeagleBoyz was the February 2016 attack on the Bangladesh Bank account at the Federal Reserve Bank of New York. AA20-239A says "The BeagleBoyz stole $81 million from the Bank of Bangladesh in 2016," and that "The Federal Reserve Bank of New York stopped the remainder of this attempted $1 billion theft after detecting anomalies in the transfer instructions."[3] The advisory ties the same group to fraudulent SWIFT abuse dating to "at least 2015."[3]

FASTCash in 30+ Countries (2018, 2020)

AA20-239A documents the FASTCash scheme, in which the BeagleBoyz "manipulate[s] interbank payment processors" to authorize fraudulent ATM withdrawals. The 2018 incidents disrupted ATM and POS services at an African bank "for almost two months," and a wiper malware at a 2018 Chilean bank "crashed thousands of computers and servers."[3] AA20-239A adds that ATM cash-outs have hit "upwards of 30 countries in a single incident," naming Argentina, Bangladesh, Brazil, Bosnia and Herzegovina, Bulgaria, Chile, Costa Rica, Ecuador, Ghana, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Pakistan, Panama, Peru, Philippines, Singapore, South Africa, South Korea, Spain, Taiwan, Tanzania, Togo, Turkey, Uganda, Uruguay, Vietnam, and Zambia as targets between 2015 and 2020.[3]

U.S. Healthcare: Maui Ransomware (May 2021 onward)

CISA's AA22-187A (July 6, 2022) attributes the Maui ransomware family to "North Korean state-sponsored cyber actors" and says it "has been used by North Korean state-sponsored cyber actors since at least May 2021 to target Healthcare and Public Health (HPH) Sector organizations."[7] CISA's AA23-040A (Feb 9, 2023) is the #StopRansomware update that carries that Maui ransomware analysis forward, under the title "Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities."[6] AA24-207A later confirms the same apparatus funds espionage via ransomware and "sometimes combin[es] ransomware and espionage on the same day."[1]

AppleJeus Cryptocurrency Malware (February 2021)

AA21-048A (February 17, 2021) exposed "AppleJeus," described as "malware that facilitates the theft of cryptocurrency," along with seven Malware Analysis Reports naming Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, and Ants2Whale.[8] The malware posed as legitimate trading applications and is one of the early documented examples of TraderTraitor-style operations against individual crypto holders.[2]

TraderTraitor Operations (2017 onward)

AA22-108A targets "organizations including cryptocurrency exchanges, decentralized finance (DeFi) protocols, play-to-earn cryptocurrency video games, cryptocurrency trading companies, venture capital funds investing in cryptocurrency, [and] individual holders of large amounts of cryptocurrency or valuable NFTs."[2] The advisory describes spear-phishing messages that "often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications."[2] Variants named in the advisory include DAFOM, TokenAIS, CryptAIS, AlticGO, Esilet, and CreAI Deck, written in cross-platform JavaScript with Node.js runtime and the Electron framework.[2]

Bybit (February 21, 2025)

FBI PSA I-022625-PSA, dated February 26, 2025, states that North Korea (DPRK) "was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit" on or about February 21, 2025.[4] The FBI refers to the activity as "TraderTraitor."[4] The PSA says TraderTraitor actors "have acted quickly, converting some stolen assets to Bitcoin and other virtual assets spread across thousands of addresses on multiple blockchains" and that the FBI "anticipates further laundering and eventual conversion to fiat currency."[4] The PSA lists the Ethereum addresses "operated by or closely connected to North Korean TraderTraitor actors" and asks private sector entities, including "RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services," and other virtual asset service providers to block transactions with or derived from the TraderTraitor addresses.[4]

The Playbook: How Lazarus Group Gets In

The same handful of techniques shows up across all three subgroups. CISA has documented them in detail.

  • Spear-phishing disguised as recruiting. AA22-108A: "messages often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications."[2] Targets typically run Windows or macOS; the same advisory catalogs DAFOM and TokenAIS (macOS), AlticGO (Windows), and CreAI Deck (Win32 and Darwin64).[2]
  • Trojanized crypto apps and supply-chain hijack. AA21-048A covered Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, and Ants2Whale.[8] Payload family after compromise: "updated macOS and Windows variants of Manuscrypt, a custom RAT with ability to execute arbitrary commands and download additional payloads."[2]
  • Exploit public-facing appliances. AA24-207A describes actors who "gain initial access through widespread exploitation of web servers through known vulnerabilities in software, such as Log4j, to deploy a web shell."[1] AA20-239A lists spearphishing attachments (T1566.001), drive-by compromise (T1189), exploit public-facing application (T1190), valid accounts (T1078), trusted relationship (T1199), and external remote services (T1133) as initial-access techniques.[3]
  • Living-off-the-land binaries. AA24-207A names "cmd, PowerShell, WMIC, and bash [T1059]."[1] Persistence uses "Scheduled Tasks."[1]
  • Credential theft and lateral movement. AA24-207A lists "Mimikatz, Dumpert, ProcDump; targeting of NTDS.dit [T1003]," plus "SMB enumeration, RDP [T1021, T1021.002]."[1] AA20-239A names "RDP (T1021.001), SMB Admin Shares (T1021.002); firewall exemptions opened on ports 443, 6443, 8443, 9443."[3]
  • C2 over disguised channels. AA24-207A: "disguised HTTP traffic, tunneling via 3Proxy, PLINK, Stunnel [T1090, T1071, T1572]."[1] AA20-239A names specific Lazarus-family RATs "CROWDEDFLOUNDER (Windows RAT, possibly Themida-packed), HOPLIGHT (fraudulent TLS sessions), VIVACIOUSGIFT, ELECTRICFISH tunneling proxies" and "COPPERHEDGE used against crypto exchanges" as "the 'tool of choice' against exchanges."[3]
  • Defense evasion via packers. AA24-207A: "VMProtect and Themida packing [T1027]."[1]
  • Exfiltration. AA24-207A: "RAR archives, cloud storage, PuTTY/WinSCP over FTP [T1560, T1039, T1048, T1567]."[1]
  • Laundering via sanctioned mixers. Treasury's August 8, 2022 Tornado Cash action cited "over $455 million" laundered for the Lazarus Group.[5] Treasury's earlier May 6, 2022 designation of the virtual currency mixer Blender.io also named Lazarus.[9]

The single most consistent lesson is also the one Treasury has been pushing for three years. The Treasury press release quotes Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson: "Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them."[5] The mixer-designation playbook (Block Blender, then Tornado Cash, then Sinbad in late 2023) is now a repeating tool, but the FBI's February 2025 PSA also shows the bureau preparing to publish address lists and asking the private sector to block at the chain level.[4]

What You Can Do If Lazarus Group Is A Threat To You

Your direct risk depends on whether you hold meaningful crypto, work at an exchange or DeFi protocol, or operate infrastructure inside the defense, aerospace, nuclear, or engineering sectors named in AA24-207A.[1] Different groups within the Lazarus umbrella target different worlds.

  • If you hold crypto on an exchange: confirm whether the exchange was in scope. The FBI's I-022625-PSA publishes the TraderTraitor addresses it says are operated by or closely connected to North Korean actors; if your platform surfaces a block on those, treat the underlying transactions as under active investigation.[4]
  • If you received a job offer you did not apply for from a recruiter at a small crypto firm, defense contractor, aerospace firm, or "play-to-earn" gaming outfit, do not run the application they send. AA22-108A's spear-phishing vector is exactly that: a fake recruiting email with a trojanized trading app.[2]
  • If you operate internet-facing appliances: AA24-207A cites Log4j as a known vulnerability exploited to plant a web shell; AA20-239A names drive-by compromise of public-facing applications as an initial-access path. Patch any web server still running a vulnerable Log4j version before the next scan.[1][3]
  • If you work in defense, aerospace, nuclear, or engineering: AA24-207A is the relevant advisory. Its target lists cover "Heavy and light tanks and self-propelled howitzers," "Littoral combat ships and combatant craft," "Submarines, torpedoes, unmanned underwater vehicles (UUVs), and autonomous underwater vehicles (AUVs)," "Fighter aircraft and unmanned aerial vehicles (UAVs)," "Missiles and missile defense systems," "Satellites, satellite communications, and nano-satellite technology," "Surveillance radar, phased-array radar, and other radar systems," "Uranium processing and enrichment," "Material waste and storage," "Nuclear power plants," "Government nuclear facilities and research institutes," "Shipbuilding and marine engineering," "Robot machinery and mechanical arms," "Additive manufacturing and 3D printing components and technology," and "Casting, fabrication, high-heat metal molding, and rubber and plastic molding."[1] Mitigations from the advisory: web application firewalls, reverse proxies, MFA on remote access, segmentation, and detection of VMProtect / Themida-packed binaries.[1]
  • If you operate a payment switch application server: AA20-239A's FASTCash mitigations apply directly. Implement MFA on switch application servers, segment payment infrastructure, require mutual TLS on payment engine links, baseline and audit switch-server logs, and verify FFIEC and PCI/SWIFT CSP controls.[3]
  • If you use a hardware wallet, you are not on the TraderTraitor path. TraderTraitor targets exchanges, DeFi protocols, and "individual holders of large amounts of cryptocurrency or valuable NFTs."[2] A non-custodial wallet keeps your keys off the platforms Lazarus compromises; it does not protect an exchange's hot wallet.
  • If you think you interacted with a sanctioned mixer: under the Treasury designations, U.S. persons are generally prohibited from transacting with blocked mixer addresses absent OFAC authorization.[5] Ask a compliance professional before sending funds.

If you are an IT or security lead at an organization in any of the above sectors, the single highest-impact change is to map your external attack surface against the AA24-207A CVE list and the AA22-108A spear-phishing pattern before the next scan. The second highest-impact change is to enforce phishing-resistant MFA on every admin portal, in line with both AA24-207A and AA22-108A.[1][2]

The Honest Takeaway

Lazarus Group is not one gang and not one playbook. It is a multi-team state apparatus that the U.S. government has chosen to break out into named advisories because that is how defenders search for guidance. AA22-108A covers the crypto front, AA20-239A covers the bank front, AA24-207A covers the espionage front, and Treasury handles the laundering front.[1][2][3][5] The attacks cluster around a few consistent techniques: spear-phishing disguised as recruiting, trojanized cryptocurrency applications, exploitation of internet-facing appliances (especially Log4Shell), living-off-the-land binaries, credential theft, and laundering through sanctioned mixers.[1][2][3][5]

The dollar math is the part that frames everything. AA20-239A puts attempted Lazarus-family thefts at "nearly $2 billion since at least 2015."[3] The February 2025 Bybit theft alone was approximately $1.5 billion, per FBI I-022625-PSA.[4] Stolen funds flow through sanctioned mixers (Tornado Cash, later Sinbad) and Treasury has named proceeds "laundered for the Lazarus Group" in the Tornado Cash designation.[5]

What does not change is the front door. The U.S. State Department's Rewards for Justice program is offering up to $10 million for information on illicit DPRK cyber operations.[1] If you have credible information, the reporting line is rewardsforjustice.net.

The sources on this page cover Lazarus Group activity documented in U.S. and partner-country advisories through 2025. It is not a complete victim list; this attacker's full footprint in the DPRK itself, and in jurisdictions where attribution has not been made public, does not appear in the pages cited.

Sources

  1. CISA, FBI, CNMF, DC3, NSA, ROK NIS, ROK NPA, UK NCSC, North Korea Cyber Group Conducts Global Espionage Campaign (AA24-207A, July 25, 2024; updated August 6, 2024)
  2. CISA, FBI, Treasury, TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A, April 18, 2022; last revised April 20, 2022)
  3. CISA, Treasury, FBI, USCYBERCOM, FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A, August 26, 2020; updated October 10, 2020)
  4. FBI Internet Crime Complaint Center, North Korea Responsible for $1.5 Billion Bybit Hack (PSA I-022625-PSA, February 26, 2025)
  5. U.S. Department of the Treasury, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Press Release jy0916, August 8, 2022)
  6. CISA, North Korean State-Sponsored Cyber Threat: Advisories (publications page, accessed October 14, 2026)
  7. CISA, North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector (AA22-187A, July 6, 2022)
  8. CISA, AppleJeus: Analysis of North Korea's Cryptocurrency Malware (AA21-048A, February 17, 2021; revised April 15, 2021)
  9. U.S. Department of the Treasury, U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats (Press Release jy0768, May 6, 2022)

Published: October 14, 2026