Who is Lazarus Group?

Lazarus Group is a threat actor attributed to KP, also known as Nickel Academy, BeagleBoyz, DEV-1222. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Lazarus Group exploit?

Lazarus Group is known to exploit 8 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Lazarus Group

Also known as: Nickel Academy, BeagleBoyz, DEV-1222, ATK 117, UNC577, Lazarus Group, Storm-1789, NewRomanic Cyber Army Team, Subgroup: Andariel, SectorA01, PLUTONIUM, HIDDEN COBRA, UNC4736, UNC2970, OperationTroy, CTG-2460, Moonstone Sleet, Onyx Sleet, Operation GhostSecret, Dark Seoul, Sapphire Sleet, Whois Hacking Team, TraderTraitor, TA404, ITG03, APT45, Jade Sleet, ATK117, Group 77, NICKEL ACADEMY, GOP, G0032, Black Artemis, Lazarus, APT38, Bluenoroff, Nickel Gladstone, Genie Spider, ATK3, UNC4034, Black Alicanto, Jumpy Pisces, Gods Disciples, CTG-6459, Operation AppleJeus, Citrine Sleet, Stonefly, Stardust Chollima, Unit 121, Operation Troy, ATK 3, COPERNICIUM, Guardian of Peace, Gods Apostles, ZINC, Appleworm, Andariel, T-APT-15, UNC4899, Gleaming Pisces, Bureau 121, G0082, Operation DarkSeoul, Alluring Pisces, Lazarus group, DEV-0139, TAG-71, COVELLITE, TA444, Silent Chollima, Labyrinth Chollima, APT-C-26, Stressed Pungsan, Guardians of Peace, Zinc, TEMP.Hermit, NICKEL GLADSTONE, Selective Pisces, Diamond Sleet, Hastati Group, Hidden Cobra, G0138, Slow Pisces, WHOis Team, Subgroup: Bluenoroff, APT 38, APT 45, Copernicium, Plutonium

KPInformation theft and espionage

Exploited CVEs

Overview

Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

Exploited Vulnerabilities

CVE ID	Action
CVE-2023-42793