Lazarus_Under_The_Hood_PDF_final.pdf (3 MB)

Kaspersky links tools used against SWIFT-supporting banking systems to Lazarus Group’s broader lateral-movement arsenal based on forensic investigations at banks in two countries. The report separates Bluenoroff as a financially focused Lazarus unit that reuses Lazarus backdoors and access while targeting banks, financial companies, traders, and casinos. It notes that early Bangladesh attribution rested mainly on shared wiper code and was not sufficient on its own, while later incidents involving Trojan-Banker.Win32.Alreay and European financial institutions provided stronger technical evidence. The activity matters because it connects espionage and sabotage-era Lazarus tooling with bank intrusions aimed at financial manipulation and SWIFT-related environments.