MITRE ATT&CK’s Lazarus Group entry maps a broad set of observed behaviors across the actor also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, Diamond Sleet, and related names. The excerpt describes credential and environment discovery through keyloggers, Active Directory queries, window-title collection, Responder-based credential harvesting, and attempts to use administrator-name permutations and weak passwords for lateral movement. Delivery and execution tradecraft includes malicious Word macros, DOTM files, PowerShell, cmd.exe, compromised websites, GitHub-hosted downloads, social engineering through LinkedIn, Twitter, and email accounts, and exploitation of Adobe Flash CVE-2018-4878. Persistence, C2, and impact behaviors include Registry Run keys and Startup-folder LNK files, HTTP/HTTPS and custom encrypted C2, Dropbox exfiltration via dbxcli, RAR or ZIP staging of stolen data, and destructive wipers that overwrite MBRs or large portions of physical and logical drives.