← Back to Actors
Lazarus Group
Lazarus GroupLabyrinth ChollimaHIDDEN COBRAGuardians of PeaceZINCNICKEL ACADEMYDiamond Sleet
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) corre...
95
Techniques
86
Covered
9
Gaps
91%
Coverage
Coverage86/95
GAPS (9)
COVERED (86)
T1001.003Protocol or Service Impersonation2 det.T1005Data from Local System47 det.T1008Fallback Channels5 det.T1010Application Window Discovery1 det.T1012Query Registry25 det.T1016System Network Configuration Discovery40 det.T1021.001Remote Desktop Protocol53 det.T1021.002SMB/Windows Admin Shares74 det.T1021.004SSH35 det.T1027.009Embedded Payloads2 det.T1027.013Encrypted/Encoded File8 det.T1033System Owner/User Discovery61 det.T1036.003Rename Legitimate Utilities47 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location45 det.T1041Exfiltration Over C2 Channel32 det.T1046Network Service Discovery51 det.T1047Windows Management Instrumentation88 det.T1048.003Exfiltration Over Unencrypted Non-C2 Protocol22 det.T1049System Network Connections Discovery22 det.T1053.005Scheduled Task100 det.T1055.001Dynamic-link Library Injection13 det.T1056.001Keylogging4 det.T1057Process Discovery21 det.T1059.001PowerShell372 det.T1059.003Windows Command Shell83 det.T1059.005Visual Basic69 det.T1070Indicator Removal62 det.T1070.003Clear Command History15 det.T1070.004File Deletion43 det.T1070.006Timestomp10 det.T1071.001Web Protocols81 det.T1074.001Local Data Staging10 det.T1078Valid Accounts297 det.T1082System Information Discovery86 det.T1083File and Directory Discovery48 det.T1090.001Internal Proxy10 det.T1090.002External Proxy8 det.T1098Account Manipulation229 det.T1102.002Bidirectional Communication16 det.T1105Ingress Tool Transfer184 det.T1106Native API29 det.T1110.003Password Spraying66 det.T1124System Time Discovery4 det.T1132.001Standard Encoding5 det.T1134.002Create Process with Token16 det.T1140Deobfuscate/Decode Files or Information58 det.T1189Drive-by Compromise10 det.T1202Indirect Command Execution58 det.T1203Exploitation for Client Execution79 det.T1204.002Malicious File441 det.T1218System Binary Proxy Execution260 det.T1218.005Mshta49 det.T1218.011Rundll3275 det.T1485Data Destruction94 det.T1489Service Stop58 det.T1491.001Internal Defacement4 det.T1529System Shutdown/Reboot18 det.T1542.003Bootkit4 det.T1543.003Windows Service79 det.T1547.001Registry Run Keys / Startup Folder53 det.T1547.009Shortcut Modification6 det.T1553.002Code Signing4 det.T1557.001Name Resolution Poisoning and SMB Relay23 det.T1560Archive Collected Data12 det.T1560.002Archive via Library1 det.T1561.001Disk Content Wipe2 det.T1561.002Disk Structure Wipe3 det.T1562.001Disable or Modify Tools316 det.T1562.004Disable or Modify System Firewall48 det.T1564.001Hidden Files and Directories25 det.T1566.001Spearphishing Attachment979 det.T1566.002Spearphishing Link1005 det.T1566.003Spearphishing via Service96 det.T1571Non-Standard Port17 det.T1574.001DLL111 det.T1574.013KernelCallbackTable2 det.T1583.001Domains62 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.002Tool13 det.T1588.004Digital Certificates1 det.T1589.002Email Addresses2 det.T1620Reflective Code Loading15 det.T1685Disable or Modify Tools279 det.T1686.003Windows Host Firewall20 det.