What other aliases and vendor names is Lazarus Group known by?

Lazarus Group is tracked across the cybersecurity industry by multiple aliases, including: 110th Research Center, 3rd Bureau, 3rd Technical Surveillance Bureau, 414 Liaison Office, Alluring Pisces, Andariel, Appleworm, APT 38.

What vulnerabilities and CVEs does Lazarus Group actively exploit?

Lazarus Group has been observed weaponizing vulnerabilities including CVE-2017-0144, CVE-2021-44228, CVE-2023-4863, CVE-2024-21413.

Lazarus Group

Q: What are the primary motivations and sponsors of Lazarus Group?

Lazarus Group operates from North Korea (DPRK) with primary motivation categorized as Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense, aerospace, and technology theft)., sponsored or affiliated with Democratic People's Republic of Korea (DPRK).

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat North Korea (DPRK)

Primary Aliases: APT38 APT45 Citrine Sleet DEV-0139

Sponsor / State Affiliation Democratic People's Republic of Korea (DPRK)

Primary Motivation Financial gain (to fund the regime and bypass sanctions) and strategic espionage (defense, aerospace, and technology theft).

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Employment-Based Social Engineering (LinkedIn/Telegram), DeFi and Cross-Chain Bridge Exploitation, Software Supply Chain Compromise

⚔️ Weaponized CVE Matrix (4)

CVE-2017-0144

EternalBlue SMBv1

CVSS 8.1 KEV EPSS 97.1%

CVE-2021-44228

Log4Shell RCE

CVSS 10.0 KEV EPSS 97.5%

CVE-2023-4863

WebP Heap Overflow

CVSS 9.8 KEV EPSS 94.2%

CVE-2024-21413

Outlook MonikerLink RCE

CVSS 9.8 KEV EPSS 89.4%

🎯 Target Sectors & Focus

Cryptocurrency Exchanges DeFi Protocols Defense Industrial Base Aerospace and Satellite Technology Semiconductor Manufacturers Software Developers Financial Services