What is known about the Lazarus Group: Sony hack, military espionage, attacks on Korean banks and other crimes
Kate Kochetkova / Kaspersky Lab :
Context & Ripple Effects
Kaspersky's profile consolidates years of scattered attribution into one picture of the Lazarus Group: the Sony Pictures hack, attacks on Korean banks, and military espionage all mapped to a single actor. The value for defenders is pattern recognition — one group, one toolset, many targets.
The corpus shows why that consolidation mattered: Symantec later tied WannaCry to the same group, and Microsoft flagged Lazarus compromising CyberLink's installer in a supply-chain attack — an evolution from targeted intrusion toward mass-distribution malware built on the same infrastructure.
First-order effects
- Security teams at banks, media companies, and government agencies gain a single reference for Lazarus's known operations, letting them match indicators against the Sony and Korean-bank intrusions rather than treating each incident as isolated.
Second-order effects
- Attribution pressure from antivirus researchers pushes Lazarus toward harder-to-trace delivery: the group's later move into compromised software installers, as in the CyberLink breach, shifts the burden of trust onto software vendors' update channels.
Third-order effects
- A state-linked group operating across espionage, bank theft, and ransomware blurs the line between cybercrime and nation-state operations, forcing defenders and regulators to treat financial theft and supply-chain compromise as national-security events.
The trend: State-backed hacking groups are converging espionage and criminal monetization in one operation, with Lazarus's arc from targeted hacks to ransomware and supply-chain attacks as the clearest running example.