IOCs by window
0
IOCs tagged #Lazarus
0
IOCs tagged #Lazarus
0
IOCs tagged #Lazarus
108
IOCs tagged #Lazarus
Counts as of 2026-10-28. Regenerated daily.
About #Lazarus
- Actor: DPRK-aligned APT, active since at least 2007. MITRE ATT&CK G0032.
- Also called: Hidden Cobra, ZINC, Diamond Sleet (Microsoft), TraderTraitor.
- Targets: Crypto exchanges, decentralised finance, banks (SWIFT), defence contractors, aerospace.
- Past ops: Sony Pictures 2014, Bangladesh Bank 2016, WannaCry 2017, Ronin / Harmony 2022.
- Tactics: Spearphishing with LinkedIn lures. npm and PyPI supply-chain attacks.
- Malware: LightlessCan, MagicLine, Manuscrypt. AppleJeus for macOS.
- References: MITRE ATT&CK G0032 · CISA AA20-239A
Recent IOCs tagged #Lazarus
No IOCs tagged #Lazarus in the past 30 days. Year total: 108. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Lazarus).
Related tags
Frequently asked questions
What is Lazarus?
A DPRK-aligned APT group, active since at least 2007. Also tracked as Hidden Cobra, ZINC, Diamond Sleet and TraderTraitor (MITRE G0032).
Is Lazarus the same as Kimsuky?
No. They are separate DPRK-aligned clusters: Lazarus focuses on financial gain, Kimsuky on intelligence collection.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Lazarus subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Lazarus IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.