Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: North Korean Threat Groups

Summary: Unit 42 reports that activity publicly called Lazarus is largely conducted by at least six distinct threat groups under the Reconnaissance General Bureau of the Korean People's Army, active as early as 2007 and supporting the North Korean government through espionage, financial gain and geopolitical disruption. The assessment reviews 10 malware families observed in recent attacks across Windows, macOS and Linux, including RustBucket, KANDYKORN, SmoothOperator, ObjCShellz, Fullhouse, POOLRAT, PondRAT and OdicLoader.

Bottom line: These groups have been active since at least 2007 and operate across all three major operating systems, so a macOS or Linux estate is not outside their reach. MITRE made North Korean threat groups a focus area of its 2024 ATT&CK enterprise evaluation, which means the techniques in this assessment are the ones being tested against defenders now.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related