Trader Traitor - DPRK Threat Actor | lazarus.day

Trader Traitor

2022-04-18 • USCISA • TraderTraitor: North Korean State-Sponsored APT T…

40

Related Actors
26

Related Reports

Related Actors

Jade Sleet

Microsoft

Trader Traitor

First seen: Jul 2023

Last seen: Oct 2024

UNC4899

Mandiant

Trader Traitor

First seen: Jul 2023

Last seen: Mar 2026

T-APT-15

Tencent

Bluenoroff

First seen: Mar 2018

Last seen: Mar 2018

APT38

Mandiant

Bluenoroff

First seen: Oct 2018

Last seen: Nov 2025

Beagle Boyz

USCISA

Bluenoroff

First seen: Aug 2020

Last seen: Mar 2021

Black Alicanto

PWC

Crypto Core

First seen: Sep 2021

Last seen: Apr 2023

Black Dev2

PWC

Bluenoroff

First seen: Sep 2021

Last seen: Apr 2023

Bluenoroff

Kaspersky

First seen: Apr 2017

Last seen: May 2026

Copernicium

Microsoft

APT38

First seen: Nov 2022

Last seen: Nov 2022

UNC785

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

Crypto Core

Clearskysec

Bluenoroff

First seen: Jun 2020

Last seen: Oct 2025

Crypto Mimic

NTTSecurity

Crypto Core

First seen: Sep 2020

Last seen: Feb 2021

UNC786

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

G0082

MITRE

APT38

First seen: Jan 2019

Last seen: Jan 2019

PUKCHONG

Google

UNC4899

First seen: Jun 2024

Last seen: Nov 2025

Leery Turtle

Cyberstruggle

Crypto Core

First seen: May 2020

Last seen: May 2020

Nickel Gladstone

Secure Works

Bluenoroff

First seen: Jun 2021

Last seen: Jun 2021

Dark River

Ptsecurity

Jade Sleet

First seen: Sep 2023

Last seen: Sep 2023

Slow Pisces

Paloalto Networks

Jade Sleet

First seen: Jun 2024

Last seen: Apr 2025

Alluring Pisces

Paloalto Networks

Bluenoroff

First seen: Sep 2024

Last seen: Feb 2025

TA444

Proofpoint

Crypto Core

First seen: Jan 2023

Last seen: Apr 2026

TEMP.Hermit

Fireeye

Bluenoroff

First seen: Mar 2023

Last seen: May 2025

Red Carpet

KRCERT

Bluenoroff

Sector A06

NSHC

Bluenoroff

First seen: Mar 2020

Last seen: Feb 2025

Stardust Chollima

Crowd Strike

Bluenoroff

First seen: Feb 2018

Last seen: Jun 2026

UNC4034

Mandiant

TEMP.Hermit

First seen: Sep 2022

Last seen: Nov 2022

UNC577

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

UNC2970

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Feb 2026

MASAN

Google

UNC1069

First seen: Nov 2025

Last seen: Nov 2025

CTG-6459

Secure Works

Nickel Gladstone

First seen: Jun 2021

Last seen: Jun 2021

Pressure Chollima

Crowd Strike

Jade Sleet

First seen: Jan 2026

Last seen: May 2026

Putrid Slug

Cloudflare

Bluenoroff

First seen: Mar 2026

Last seen: Mar 2026

Sapphire Sleet

Microsoft

Copernicium

First seen: Apr 2023

Last seen: Jun 2026

JINX-0164

Wiz

Sapphire Sleet

First seen: May 2026

Last seen: May 2026

Storm-0954

Microsoft

Jade Sleet

First seen: Apr 2023

Last seen: Apr 2023

TAG-71

Recorded Future

Bluenoroff

First seen: Jun 2023

Last seen: Jan 2024

UNC1069

Mandiant

Crypto Core

First seen: Apr 2023

Last seen: May 2026

UNC1758

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Apr 2023

ATK117

Thales Group

APT38

First seen: Oct 2019

Last seen: May 2022

REF9135

Elastic

Bluenoroff

First seen: Jun 2023

Last seen: Jun 2023

Related Reports

Top Authors

View all reports in this cluster

2026-05-29

SOCRadar

April 2026: ShinyHunters Hits Medtronic and ADT as North Korean Hackers Drain DeFi Protocols

#Lazarus #TraderTraitor #UNC1069 #DriftProtocol #KelpDAO #Axios #NPM #SupplyChain #WAVESHAPER #Trend

2026-05-18

Layer Zero

LayerZero Labs KelpDAO Incident Report

#KelpDAO #TraderTraitor

2026-04-28

Recorded Future

Lazarus Doesn't Need AGI

#Lazarus #TraderTraitor

2026-04-20

Layer Zero

KelpDAO Incident Statement

#KelpDAO #TraderTraitor

2026-03-16

Break Glass Intelligence

Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months

#TraderTraitor #T1059.007 #T1082 #T1036 #T1041 #T1008 #T1027 #T1070.009 #T1622 #T1573.001 #T1571 #T1497.003 #T1102.001 #T1583.003 #T1195.001

2025-11-25

Slowmist

The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities

#Lazarus #TraderTraitor #ITWorker

2025-10-22

Tay

There's a new DPRK report making the rounds. I have thots.

#CryptoCore #TraderTraitor #BtcTurk

2025-10-22

MSMT

The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities

#ITWorker #Sanctions #Whitepaper #CryptoCore #TraderTraitor #Bybit #DMM #WazirX

2025-07-28

Wiz

TraderTraitor: Deep Dive

#Bybit #DMM #JumpCloud #NPM #TraderTraitor #T1027 #T1566.003 #T1552.004 #T1195.001 #T1082 #T1566.001 #T1553.002 #T1199 #T1609 #T1078 #T1059.007 #T1041 #T1555 #T1550.004 #T1588.003 #T1204.002 #T1105 #T1071.001 #T1195.002 #T1059.006 #T1087.004 #T1566.002 #T1580 #T1578.005 #T1059

2025-07-22

Validin

Substantial Upgrades to Crawling History, Artifact Collection

#Bybit #TraderTraitor

2025-07-16

Zeroshadow

How Industry Leaders Can Change Crypto Freezes and Recovery

#Bybit #MoneyLaundering #TraderTraitor

2025-06-27

Invictus IR

Profiling TradeTraitor: Tactics, History & Defenses

#TraderTraitor

2025-05-14

Dtex Systems

Exposing DPRK’s Cyber Underworld

#ITWorker #APT37 #APT43 #APT45 #AppleJeus #CryptoCore #GwisinGang #Konni #MoonstoneSleet #RubySleet #TEMP.Hermit #TraderTraitor #Whitepaper

2025-05-06

Elastic

Bit ByBit - emulation of the DPRK's largest cryptocurrency heist

#Bybit #SafeWallet #TraderTraitor

2025-04-22

S2W

Analysis of TraderTraitor’s GopherGrabber Malware observed by Willo Campaign

#GopherGrabber #TraderTraitor #Willo

View all reports in this cluster