Lexfo-WhitePaper-The_Lazarus_Constellation.pdf (2 MB)

Lexfo’s Lazarus Constellation white paper summarizes Lazarus as a North Korea-linked APT whose activity has been traced back to 2007 and formally clustered in the 2016 Operation Blockbuster research. The excerpt emphasizes the group’s reuse of large code blocks across more than 45 in-house malware families and its evolution from destructive cyberterrorism and vandalism into persistent espionage and financially motivated operations. Lexfo distinguishes at least three subgroups by mission and targeting: a Lazarus core focused on disruption, Andariel for profit and intelligence collection, and Bluenoroff for financial gain, while noting attribution evidence such as C2 logins from North Korean IP addresses and compilation timestamps consistent with North Korean working hours.