Arsenal attributed to Lazarus Group.
Following MITRE ATT&CK Flow methodology.
Interactive MITRE ATT&CK Navigator layer for Lazarus Group (G0032).
| CVE | Year | Description |
|---|---|---|
| CVE-2021-44228 | 2021 | Log4Shell — rapidly adopted for initial access |
| CVE-2022-0609 | 2022 | Chrome zero-day for watering hole attacks on crypto companies |
| CVE-2023-42793 | 2023 | JetBrains TeamCity RCE for supply chain access |
| CVE-2021-21148 | 2021 | Chrome V8 heap buffer overflow zero-day |
| CVE-2020-9395 | 2020 | Adobe Reader RCE used in targeted attacks |
Documented in MITRE ATT&CK, vendor intelligence, and government advisories.
Mitigations with MITRE ATT&CK IDs. Click badges for implementation guidance.
| Plan | Source | Type | Description | Link |
|---|---|---|---|---|
| CISA AppleJeus Malware Analysis | CISA | Guide | Technical analysis of AppleJeus with IOCs and detection guidance | Open |
| Elastic KANDYKORN Analysis | Elastic Security Labs | Guide | macOS KANDYKORN backdoor analysis with detection rules | Open |
| Lazarus/BlueNoroff Research Collection | GitHub / tayvano | Open Source | Comprehensive collection of DPRK APT articles, analysis, heists, and IOCs with 200+ entries | Open |
| ATT&CK Evaluations - DPRK (Lazarus) | MITRE Engenuity | Framework | Official ATT&CK Evaluation with Lazarus macOS and Windows emulation scenarios | Open |
| CISA Alert: TraderTraitor DPRK | CISA | Guide | Advisory covering Lazarus cryptocurrency targeting with TraderTraitor malware TTPs | Open |
| Lazarus Group: Criminal Syndicate with a Flag | Barracuda Networks | Blog Post | Deep dive into Lazarus hierarchy, subgroups, cryptocurrency targeting, and operational structure | Open |
| Emulating the North Korean Adversary Lazarus Group | AttackIQ | Blog Post | Six attack graphs emulating Lazarus campaigns: Operation Sharpshooter, Rising Sun implant, cryptocurrency targeting | Open |