← Back to Actors
Lazarus Group
Lazarus GroupLabyrinth ChollimaHIDDEN COBRAGuardians of PeaceZINCNICKEL ACADEMYDiamond Sleet
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) corre...
95
Techniques
86
Covered
9
Gaps
91%
Coverage
Coverage86/95
GAPS (9)
COVERED (86)
T1001.003Protocol or Service Impersonation2 det.T1005Data from Local System51 det.T1008Fallback Channels5 det.T1010Application Window Discovery1 det.T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1021.001Remote Desktop Protocol55 det.T1021.002SMB/Windows Admin Shares74 det.T1021.004SSH38 det.T1027.009Embedded Payloads2 det.T1027.013Encrypted/Encoded File8 det.T1033System Owner/User Discovery62 det.T1036.003Rename Legitimate Utilities47 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location49 det.T1041Exfiltration Over C2 Channel32 det.T1046Network Service Discovery53 det.T1047Windows Management Instrumentation88 det.T1048.003Exfiltration Over Unencrypted Non-C2 Protocol23 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1055.001Dynamic-link Library Injection13 det.T1056.001Keylogging4 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1070Indicator Removal68 det.T1070.003Clear Command History15 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1071.001Web Protocols83 det.T1074.001Local Data Staging10 det.T1078Valid Accounts320 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1090.001Internal Proxy10 det.T1090.002External Proxy9 det.T1098Account Manipulation258 det.T1102.002Bidirectional Communication17 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1110.003Password Spraying73 det.T1124System Time Discovery4 det.T1132.001Standard Encoding5 det.T1134.002Create Process with Token16 det.T1140Deobfuscate/Decode Files or Information59 det.T1189Drive-by Compromise13 det.T1202Indirect Command Execution60 det.T1203Exploitation for Client Execution81 det.T1204.002Malicious File468 det.T1218System Binary Proxy Execution270 det.T1218.005Mshta51 det.T1218.011Rundll3278 det.T1485Data Destruction100 det.T1489Service Stop59 det.T1491.001Internal Defacement4 det.T1529System Shutdown/Reboot19 det.T1542.003Bootkit4 det.T1543.003Windows Service80 det.T1547.001Registry Run Keys / Startup Folder53 det.T1547.009Shortcut Modification6 det.T1553.002Code Signing4 det.T1557.001Name Resolution Poisoning and SMB Relay23 det.T1560Archive Collected Data12 det.T1560.002Archive via Library1 det.T1561.001Disk Content Wipe2 det.T1561.002Disk Structure Wipe3 det.T1562.001Disable or Modify Tools332 det.T1562.004Disable or Modify System Firewall50 det.T1564.001Hidden Files and Directories26 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1566.003Spearphishing via Service107 det.T1571Non-Standard Port17 det.T1574.001DLL111 det.T1574.013KernelCallbackTable2 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.002Tool13 det.T1588.004Digital Certificates1 det.T1589.002Email Addresses2 det.T1620Reflective Code Loading17 det.T1685Disable or Modify Tools281 det.T1686.003Windows Host Firewall22 det.