Lazarus Group Threat Actor Profile: Crypto Theft, Fake Recruiters and Defences

Lazarus Group is the North Korean state cluster most associated with stealing cryptocurrency at scale, and it gets in by social engineering the engineers and administrators who hold the keys. This profile sets out who the group is, which aliases map to it, what it targets, and the techniques that US government advisories and MITRE ATT&CK attribute to it. It focuses on the identity side: how a fake job offer becomes a stolen cloud session token, and how that token becomes a signed transaction. It is written for security operations, identity and platform teams at exchanges, fintechs, Web3 projects and any software company whose developers hold production access. It describes behaviour for defenders and contains no attacker tooling steps.

Key takeaways

• Lazarus is an umbrella name. MITRE ATT&CK (G0032) and Mandiant both note that "Lazarus" is used publicly for several units of the Reconnaissance General Bureau (RGB), including the crypto-focused cluster the FBI calls TraderTraitor.
• Money is the main driver. The FBI attributed the theft of about USD 1.5 billion from Bybit on or about 21 February 2025 to TraderTraitor, and the US Treasury said in November 2025 that North Korea-affiliated actors had stolen over USD 3 billion in three years, mostly in cryptocurrency.
• The entry point is a person, not a perimeter. Recruiter lures, "pre-employment tests" and trojanised trading apps target system administrators and DevOps staff first, as CISA advisory AA22-108A records.
• Developer credentials are the prize. In the Bybit case a developer laptop yielded an AWS session token that bypassed MFA, and the attackers then altered code that signers relied on.
• Defences that work are boring and strict: isolated environments for any third-party code, short-lived credentials, phishing-resistant MFA, multi-party approval for fund movements, and monitoring for session reuse from unexpected networks.

Who they are (names and aliases)

MITRE ATT&CK describes Lazarus Group as a North Korean state-sponsored group attributed to the RGB, active since at least 2009 and reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment. ATT&CK also warns that North Korean units share personnel, infrastructure and malware, so attribution of a single operation to a single unit is often low confidence. Treat the names below as overlapping labels, not as a clean one-to-one mapping.

For how vendor naming schemes relate to one another, see the Threat Actor Groups Guide.

Targeting and motivation

US advisories describe a mix of revenue generation and access. AA22-108A (FBI, CISA and Treasury, 18 April 2022) lists the targets as cryptocurrency exchanges, decentralised finance (DeFi) protocols, play-to-earn game companies, trading firms, venture capital funds investing in crypto, and individuals holding large amounts of cryptocurrency or valuable NFTs. It notes that employees in system administration or DevOps roles are often the first people approached.

• Revenue for the state: stolen assets are laundered quickly. In the Bybit case the FBI said the actors had already converted some assets to Bitcoin and expected further laundering and conversion to fiat currency.
• Supply chain leverage: compromising a software or identity provider gives access to its customers. Mandiant's analysis of the 2023 JumpCloud intrusion showed the actor using the platform's command framework to reach a crypto-sector customer.
• Selective, high-value targeting: Mandiant observed reconnaissance on executives and internal security teams, and theft from macOS keychains.
• Destructive capability: ATT&CK records data destruction (T1485) and disk structure wiping (T1561.002), consistent with the Sony Pictures attack.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 lists over 90 techniques for G0032. The table below selects those most relevant to identity and crypto theft, with the source for each. All IDs were checked against ATT&CK v20.

How they abuse identities and credentials

The pattern across a decade of reporting is consistent: build a believable persona, get one trusted person to run code, take that person's credentials and sessions, then act as them.

1. Persona and pretext: the FBI's September 2024 PSA (I-090324-PSA) describes pre-operational research on professional networking sites, tailored job or investment offers, long rapport-building conversations, and impersonation of recruiters and known contacts using stolen photos and fake websites.
2. Code execution on a trusted device: the lure is a trading app (AppleJeus, TraderTraitor apps such as DAFOM or TokenAIS), a take-home test, or a request to run a script to "unlock" video calling. Microsoft's March 2026 analysis of the Contagious Interview campaign describes repositories that run automatically once a developer trusts the project in Visual Studio Code.
3. Credential harvest: Microsoft lists what such implants collect: API tokens, cloud credentials, signing keys, wallet mnemonics, password manager data and environment files. These are mostly non-human credentials sitting on a human's laptop.
4. Session reuse: in the Bybit case, Safe's preliminary findings reported that the attackers hijacked an active AWS session token because AWS required MFA every 12 hours, and timed their activity to the developer's working hours. See the Token and Session Security Guide.
5. Abuse of trusted change paths: with the developer's access, the attackers altered code that the exchange's signers relied on, so legitimate approvers signed a malicious transaction.

The lesson for identity teams is that developer endpoints are where long-lived and short-lived machine credentials converge. See the Endpoint Security Guide and the Secrets Management Guide.

A separate but related North Korean revenue stream places IT workers inside companies under false identities. FBI PSAs of 23 January 2025 and 23 July 2025 describe source code theft, extortion, harvesting of credentials and session cookies, and US-based facilitators hosting company laptops. Public reporting does not always tie these workers to Lazarus, so treat them as a parallel risk. See the Insider Threat from Fake IT Workers Guide.

Notable incidents

The Bybit hack 2025 and the JumpCloud breach are analysed in detail on NHI Mgmt Group breach pages. A related March 2026 npm supply chain compromise of axios was attributed by Google Threat Intelligence Group to UNC1069, a different North Korea-nexus financially motivated cluster, not to Lazarus by name; see the axios npm compromise 2026.

Detection and defence

Controls mapped to the techniques

Phased rollout

1. First 30 days: identify everyone who can move funds, sign releases or hold production cloud access. Brief them using the indicators in FBI PSA I-090324-PSA. Ban running recruiter or third-party code on corporate devices.
2. Days 30 to 60: enforce phishing-resistant MFA for cloud consoles, source control and CI/CD. Cut console session lifetimes and turn on alerts for session use from VPN providers and new ASNs. Pilot in report-only mode with one team, then enforce.
3. Days 60 to 90: move signing keys and wallet keys off endpoints. Require multi-party approval with independent verification of the transaction payload, not just the interface that displays it.
4. Ongoing: run purple-team exercises based on the AA22-108A pattern. Keep a rollback route for each control (for example, a break-glass account with monitored use) so a false positive does not stop releases.

What to monitor

• Editor-to-shell chains: code editors or Node.js spawning shells that then download content, as Microsoft recommends hunting for.
• Cloud session anomalies: the same session or role used from two networks, or from commercial VPN exit nodes, which Mandiant reported UNC4899 uses as a final hop.
• Changes to signing or wallet front-end code: any change outside the normal pipeline, especially shortly before high-value transactions.
• Developer secrets on disk: scan endpoints for long-lived tokens in environment files.

Metrics

• Percentage of privileged and signer accounts on phishing-resistant MFA (target 100 percent).
• Median lifetime of cloud console and CLI sessions for production roles.
• Number of long-lived tokens found on developer endpoints per quarter, trending down.
• Percentage of high-value transactions verified on an independent channel before signing.
• Time from session anomaly alert to session revocation.

Small organisations should start with the ban on running external code on work devices and with hardware-backed MFA, which cost little. Larger exchanges and custodians need dedicated signing infrastructure and a security team that watches session telemetry continuously. See the Crypto Exchange Identity and Key Security Guide and the Web3 and Crypto Security Guide.

Common failure patterns

• Treating MFA as the end of the story: at Bybit, MFA was enforced every 12 hours but a stolen session token made it irrelevant. Session binding and anomaly detection matter as much as the login.
• Running interview code on the work laptop: the most common initial step in AA22-108A and the 2024 and 2026 reporting. The fix is a disposable environment with no credentials.
• Trusting what the signing interface shows: approvers in the Bybit theft signed what a modified front end presented. Independent payload verification is the control.
• Over-trusting an identity provider's agent: the JumpCloud breach showed management agents can be used to push commands to customers. Monitor what those agents execute.
• Slow key rotation after compromise: AA21-048A advises generating new wallet keys or moving funds after an AppleJeus infection; delay gives the actor time to act.

Practitioner checklist

• List every human and machine identity that can move funds, sign code or change production, and review it quarterly.
• Prohibit running recruiter, investor or third-party code on corporate devices; provide a disposable environment instead.
• Enforce phishing-resistant MFA on cloud consoles, source control, CI/CD and identity providers.
• Shorten production session lifetimes and alert on session use from new networks or VPN providers.
• Keep wallet and signing keys in HSMs or multi-party schemes, never on laptops.
• Require multi-party approval with independent verification of transaction payloads.
• Hunt for editor or Node.js processes spawning shells that download content.
• Block transactions with addresses listed in FBI PSAs and report suspected activity to IC3.

Standards and references

• FBI: North Korea Responsible for 1.5 Billion USD Bybit Hack (I-022625-PSA)
• CISA, FBI and Treasury: TraderTraitor, North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A)
• CISA, FBI and Treasury: AppleJeus, Analysis of North Korea's Cryptocurrency Malware (AA21-048A)
• FBI: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)
• MITRE ATT&CK: Lazarus Group (G0032)
• Mandiant: North Korean supply chain intrusion via JumpCloud (UNC4899)
• Microsoft: Contagious Interview Malware Delivered Through Fake Developer Job Interviews
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Threat Actor Groups Guide · Web3 and Crypto Security Guide · Crypto Wallet Security Guide · Insider Threat from Fake IT Workers Guide · Phishing-Resistant MFA Guide