There is no consensus on what to call the North Korean hacking unit that researchers have linked to a string of cyber incidents since the early 2010s.
Various Names Used by Different Agencies
The United States Department of Homeland Security refers to the group as Hidden Cobra. Microsoft labels it ZINC. Cybersecurity companies have applied other tags such as Guardians of Peace, Whois Team and Diamond Sleet. A defector who identified himself as Kim Kuk‑song told investigators that inside North Korea the unit is known as the 414 Liaison Office.
This variety of labels is not simply bureaucratic confusion; it reflects the complexity of the organization. Researchers have traced a wide‑ranging series of cyberattacks back to a single state‑sponsored entity, yet the exact composition and internal hierarchy remain undisclosed. The deliberate opacity serves a purpose: it makes the group harder to pin down.
Because of its stealthy, long‑term approach, the unit is classified as an advanced persistent threat. That designation implies patience, substantial resources and a persistent presence. The United States Department of Justice has asserted that the group operates as part of the North Korean government’s broader strategy to weaken global cybersecurity and to earn illicit revenue that evades international sanctions.
Consequently, the unit pursues two intertwined objectives. One is disruption, evident in a long list of attributed intrusions targeting banks, cryptocurrency exchanges and entertainment firms that stretch back more than ten years. The other is financial gain, which is harder to observe but equally central to the mission. Tight sanctions on North Korea make conventional revenue streams difficult, so cyber operations provide a means to generate income that would otherwise be blocked.
Security analysts describe this as an asymmetric threat. North Korea does not need a large navy or a modern air force to inflict damage; a small, skilled team of hackers operating from the 414 Liaison Office can reach across the globe. They can compromise financial systems, steal intellectual property or disrupt critical infrastructure. The cost to the attackers is relatively low, while the potential harm to victims can be enormous.
For governments and cybersecurity organizations attempting to counter the threat, the first obstacle is basic identification: who exactly are they tracking? The multiplicity of names stems from genuine uncertainty. Different agencies observe different facets of the same operation and assign labels based on what they see, producing a fragmented picture. Consequently, Guardians of Peace, Hidden Cobra, ZINC and Diamond Sleet may refer to the same unit, to overlapping elements, or to sub‑components within a larger structure. No external observer can confirm the true arrangement with certainty.
Kim Kuk‑song’s testimony offers a rare internal designation—the 414 Liaison Office—but a single defector’s account does not fill the broader intelligence gaps. As of March 24, 2023, the Lazarus Group continues to be a significant concern for global cybersecurity. Its activities remain under close watch by security firms and governments worldwide, and many analysts are still working to understand the full scope and intentions behind the campaigns.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Mysterious Lazarus Group Defies Easy Classification and Understanding Completely”, “description”: “There is no consensus on what to call the North Korean hacking unit that researchers have linked to a string of cyber incidents since the early 2010s.”, “datePublished”: “2026-06-21T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Muhammad Asim”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://infopulsetoday.com/wp-content/uploads/sites/3/rehomed/s26/2026/05/lazarus-group-probed-as-doj-reveals-two-cyber-goals-a.jpg”}
