Lazarus Group

Not a company: the name security researchers gave in 2016 to hacking units the US, UN and others say work for North Korea's Reconnaissance General Bureau (with sub-units BlueNoroff/APT38, Andariel, TraderTraitor).

A state-run theft programme: the 2014 Sony wipe, the $81M Bangladesh Bank SWIFT heist, WannaCry, and about $6.75B of crypto stolen from exchanges, bridges and wallets by end-2025, laundered to fund North Korea's weapons programmes. North Korea denies it.

Novetta's Operation Blockbuster report named the 'Lazarus Group' in February 2016 for the units behind the 2014 Sony Pictures attack; days earlier they had moved $81 million out of Bangladesh Bank's account at the New York Fed. The US named its first North Korean hacker, Park Jin Hyok, in September 2018 and sanctioned the group and its sub-units in 2019; a 2021 indictment added Jon Chang Hyok and Kim Il and a $1.3 billion campaign of bank and exchange thefts. Crypto became the main line: Ronin in 2022 ($625 million) and Bybit in February 2025 ($1.5 billion, the largest heist on record) pushed the running total to about $6.75 billion by the end of 2025. Rim Jong Hyok was charged in 2024 for hospital ransomware that funded espionage. None of the accused has been arrested.

OFAC sanctioned Lazarus Group, Bluenoroff and Andariel on 13 September 2019 and its front Chosun Expo on 6 September 2018. US complaints and indictments name Park Jin Hyok (2018), Jon Chang Hyok, Kim Il (2021) and Rim Jong Hyok (2024); rewards up to $10M. Marine Chain, a 2017–18 token offering marketed in Singapore, was part of the 2021 indictment. No member has been arrested.