Lazarus Group: A criminal syndicate with a flag
2025-09-23 • Barracuda •
https://blog.barracuda.com/2025/09/23/lazarus-group--a-criminal-syndicate-with-a-flag
Barracuda profiles Lazarus Group as a DPRK state-linked cybercrime and espionage ecosystem operating under the Reconnaissance General Bureau rather than a single monolithic actor. The article distinguishes major clusters including TEMP.Hermit, Kimsuky/APT43, APT38/Bluenoroff, and Andariel/APT45, with missions spanning government, defense, telecom, finance, cryptocurrency, healthcare, and academic targets. It describes how these clusters share tools, infrastructure, and personnel while pursuing both intelligence collection and revenue generation, including cryptocurrency theft, ransomware, SWIFT-enabled bank fraud, destructive attacks, and espionage. The report places Lazarus activity in the context of sanctions pressure and DPRK weapons funding, citing large-scale suspected crypto theft and historical operations such as Operation Troy, DarkSeoul, Sony Pictures, and the Bangladesh Bank heist.