Mezha

Russia and North Korea Collaborate in Cyber Operations

First seen 2 Dec 2025, 18:33 UTC • Mezha

•41.2

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Research indicates that Russian APT group Gamaredon and North Korean Lazarus Group are collaborating by sharing operational infrastructure. This partnership marks a significant development in state-sponsored cyber activities, with both groups reportedly active on the same server and exchanging resources for potential global attacks.

How this analysis works

Attack Flow

9 entities, 18 inferred relationships (STIX 2.1).

Threat Actor (3)

Gamaredon
Lazarus
Lazarus Group

Technique (2)

Malware
T1071 - Command And Control

Campaign (2)

Contagious Interview
ContagiousInterview

Malware (1)

InvisibleFerret

Affected Platform (1)

Relationships

Gamaredon uses InvisibleFerret
Lazarus uses InvisibleFerret
Lazarus Group uses InvisibleFerret
Gamaredon uses Malware
Gamaredon uses T1071 - Command And Control
Lazarus uses Malware
Lazarus uses T1071 - Command And Control
Lazarus Group uses Malware
Lazarus Group uses T1071 - Command And Control
Contagious Interview attributed to Gamaredon
Contagious Interview attributed to Lazarus
Contagious Interview attributed to Lazarus Group
ContagiousInterview attributed to Gamaredon
ContagiousInterview attributed to Lazarus
ContagiousInterview attributed to Lazarus Group
Contagious Interview uses InvisibleFerret
ContagiousInterview uses InvisibleFerret
Gamaredon related to Telegram

Continue Reading

Sandworm Launches Wiper Malware Campaign Against Ukrainian Organizations Gamaredon Exploits WinRAR Vulnerability in Ongoing Ukraine Campaign Exploitation of WinRAR CVE-2025-8088 Threatens Ukrainian Organizations Gamaredon APT Escalates Cyber Operations Against Ukraine in 2025 Malaysia's Cyber Threat Landscape Faces Significant Transformation Amid Digital Expansion Sandworm Hackers Target Ukraine's Grain Sector with Data-Wiping Malware

Russia and North Korea Collaborate in Cyber Operations

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading