North Korea's Lazarus Group Divided into Six Cyber Clusters

Recent analysis by Sekoia and Kudelski Security reveals that North Korea's Lazarus Group operates through six distinct cyber clusters, focusing on espionage, financial activities, and sanctions evasion. The clusters include TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, each characterized by specific tactics and operations. The reorganization of these units complicates attribution and mapping of North Korea's cyber capabilities. Thousands of IT workers, operating under false identities, support these operations by generating revenue and gaining access to organizations. This network extends globally, leveraging front companies and educational institutions in regions like China, Russia, and Africa. The report highlights the dual mandate of these clusters, blending espionage with financial motives, particularly in cryptocurrency theft. The findings emphasize the ongoing threat posed by North Korean cyber operations, which are integral to the regime's survival strategy.

Key Points: • North Korea's Lazarus Group is now categorized into six distinct cyber clusters. • Thousands of IT workers under false identities support North Korea's cyber operations. • The clusters blend espionage and financial activities, complicating attribution efforts.