Search OpenSanctions

Lazarus Group

Sanction-linked entity

Lazarus Group is an entity of interest. It has not been found on international sanctions lists.

Type	Organization				[sources]
Name	Lazarus Group				[sources]
Other name	Guardians of Peace · Hidden Cobra · Whois Team · Zinc				[sources]
Legal form	not available				[sources]
Country	North Korea				[sources]
Description	North Korean cybercrime group controlled by the Reconnaissance General Bureau (RGB; KPe.031).				[sources]
Status	not available				[sources]
Source link	www.nknews.org				[sources]
Last change	2024-06-18	Last processed	2024-10-29	First seen	2023-08-08

Descriptions

According to Footnote 110 (p. 50) of the UN Panel of Experts March 2019 report, Lab 110 could be the same organization as Lazarus Group: "The United States stated that Chosun Expo is “a front company affiliated with Lab 110, one of the North Korean government’s hacking organizations. That hacking group is what some private cybersecurity researchers have labeled the “Lazarus Group.”".

— DPRK Reports non-official source, 2023-08-08

Relationships

Linked from
Subject	Role	Start date	End date
Third Bureau of the Reconnaissance General Bureau	The Lazarus Group is reported to be included in the Third Bureau of the Reconnaissance General Bureau	-	-
Kim Hyon Woo	Kim Hyon Woo is a fake persona used by the Lazarus Group	-	-
Reconnaissance General Bureau	The Reconnaissance General Bureau oversees all North Korean cybercrime activities, Lazarus group included	-	-
JMT Trader	Linked	-	-
UNC 4899	The entities have "overlaps"	-	-
Celas Ltd.	Celas is a fake shell company backed by the Lazarus group	-	-
Stardust Chollima	BlueNoroff (Stardust Chollima) is a subgroup of the Lazarus Group	-	-

Linked to
Object	Role	Start date	End date
110 Research Institute of the Reconnaissance General Bureau	Larazus Group is working with or on behalf of the 110 Research Institute	-	-
Andariel	Andariel is a subgroup of Lazarus	-	-

Members
Member	Role	Start date	End date
Park Jin Hyok	Member	-	-

Data sources

DPRK Reports5,540

A database of entities and events related to North Korea's sanctions evasion efforts.

United Kingdom · RUSI · non-official source

External databases

The record has been enriched with data from the following external databases:

Graph-based entity tagging63,551

Automatically generated graph-based topic annotations

External dataset · OpenSanctions · non-official source

For experts: raw data explorer

Factsheet Descriptions Data sources

OpenSanctions is free for non-commercial users. Businesses must acquire a data license to use the dataset.

Use the API License in bulk

Linked from
Subject	Role	Start date	End date
Third Bureau of the Reconnaissance General Bureau	The Lazarus Group is reported to be included in the Third Bureau of the Reconnaissance General Bureau	-	-
Kim Hyon Woo	Kim Hyon Woo is a fake persona used by the Lazarus Group	-	-
Reconnaissance General Bureau	The Reconnaissance General Bureau oversees all North Korean cybercrime activities, Lazarus group included	-	-
JMT Trader	Linked	-	-
UNC 4899	The entities have "overlaps"	-	-
Celas Ltd.	Celas is a fake shell company backed by the Lazarus group	-	-
Stardust Chollima	BlueNoroff (Stardust Chollima) is a subgroup of the Lazarus Group	-	-

Linked to
Object	Role	Start date	End date
110 Research Institute of the Reconnaissance General Bureau	Larazus Group is working with or on behalf of the 110 Research Institute	-	-
Andariel	Andariel is a subgroup of Lazarus	-	-

Members
Member	Role	Start date	End date
Park Jin Hyok	Member	-	-