Thirty-five payment orders. $951 million. That was the haul hackers tried to pull out of Bangladesh Bank’s SWIFT system in February 2016, in a heist attributed to the Lazarus Group, the label for North Korea’s state hacking operations.
Lazarus is not a single crew with a tidy org chart. Researchers at EuRepoC, a European cyber-incident repository, wrote in 2024 that there is “little consolidated, broadly-recognised knowledge” about the group’s place inside the North Korean state, and that threat intelligence firms, academics and governments share no clear picture of how its cyber units are arranged. The name works as a label for a wide set of operations and sub-groups, which is why pinning a specific attack on it is so often hard.
Who sits behind the name
The broad view is consistent. MITRE ATT&CK describes Lazarus Group as a North Korean state-sponsored group attributed to the Reconnaissance General Bureau, active since at least 2009. EuRepoC says North Korean cyber activity of any kind is most likely directed or controlled by that bureau, and that most sources link Lazarus to its Lab 110. Mandiant, in a 2023 report, presents Lab 110 as a reorganised, expanded version of Bureau 121, long seen as the country’s main hacking unit. Older South Korean academic work took Lab 110 to be a subordinate of Bureau 121.
Every vendor has its own label for the same ecosystem. CrowdStrike says Labyrinth Chollima. Microsoft says Diamond Sleet, formerly ZINC. The US government calls the activity HIDDEN COBRA, Secureworks uses NICKEL ACADEMY, and McAfee has used Whois Hacking Team. The group even named itself once: Guardians of Peace.
The record
MITRE ties the group to the November 2014 destructive wiper attack on Sony Pictures Entertainment, which Novetta tracked as Operation Blockbuster. bdnews24 adds the 2017 WannaCry ransomware outbreak and the 2018 theft of $530M from the Coincheck crypto exchange, and says $400M went in crypto platform breaches in 2021, with proceeds reportedly funding North Korea’s weapons programmes.
The Bangladesh Bank case shows the method. According to bdnews24, operatives spent months mapping the network, then used custom malware to manipulate SWIFT terminals. Most of the fraudulent orders failed. A spelling error and alert bank staff blocked them. A request to send money to a nonexistent Sri Lankan “Shalika Foundation” raised flags. Five transactions worth $81 million still reached accounts in the Philippines, and roughly $20M was later recovered. SWIFT responded with mandatory Customer Security Controls, 27 requirements in all.
The strategic point is how North Korea has built a state hacking apparatus that steals money and disrupts targets at the same time, while staying hard to tie to any one team. MITRE notes that its units reorganise as national priorities change and share personnel, infrastructure, malware and tradecraft. That shared toolkit is exactly what blurs attribution.
Sources
- Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet, Group G0032 (MITRE ATT&CK)
- APT Profile – Lazarus Group: The APT with countless lives (EuRepoC, European Repository of Cyber Incidents)
- Lazarus Group SWIFT Hack: How APT38 Stole $81M from Bangladesh Bank (bdnews24.net, Elena Morozova)
