Menu

Individual skill

lazarus-group

Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.

packages/decepticon/decepticon/skills/shared/adversary-emulation/lazarus-group/SKILL.md

Read pinned source

Source commit df879550544d36b6b1e69062f05adae28537adf2

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
6,567
Repository last updated
Nov 7, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Lazarus Group (Hidden Cobra, Diamond Sleet, Labyrinth Chollima) — Adversary Emulation Profile

Lazarus Group (MITRE ATT&CK **G0032**) is a North Korean state-sponsored threat actor active since at least 2009 and attributed by the U.S. Government and the security industry to the DPRK's Reconnaissance General Bureau (RGB). It is one of the most versatile and prolific nation-state actors observed, running three overlapping mission types in parallel: strategic **espionage**, **destructive/disruptive** attacks (e.g., the 2014 Sony Pictures wiper and the 2017 WannaCry outbreak), and large-scale **financially motivated** theft to fund the sanctioned regime (SWIFT bank fraud, ATM "FASTCash" cash-outs, and cryptocurrency heists). MITRE and vendors track several clusters/aliases under or alongside the Lazarus umbrella — **HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet (Microsoft), and Labyrinth Chollima (CrowdStrike)** — with financial sub-clusters often labeled APT38 / BlueNoroff / Stardust Chollima. The group blends bespoke malware, trojanized legitimate software, supply-chain compromise, and elaborate social engineering (fake recruiter "job offers") to reach hardened targets.

## Attribution & motivation
- **Suspected sponsor / nation:** North Korea (DPRK), tied to the Reconnaissance General Bureau (RGB). The U.S. Government uses the umbrella name **HIDDEN COBRA** for DPRK malicious cyber activity.
- **Motivation (mixed):**
  - **Financial** — sanctions-driven revenue generation: SWIFT interbank fraud, FASTCash ATM cash-outs, and cryptocurrency theft from exchanges, DeFi, and blockchain firms.
  - **Espionage** — collection against defense, aerospace, government, and crypto/fintech targets, frequently via fake-job-offer lures (Operation Dream Job).
  - **Destructive / disruptive** — wiper and ransomware operations (Sony Pictures 2014; WannaCry 2017).
- **Confidence of attribution:** **High.** Backed by a 2018 U.S. DOJ criminal complaint naming DPRK programmer Park Jin Hyok, multiple joint FBI/CISA/Treasury/USCYBERCOM advisories, and corroborating Mandiant/ESET/Kaspersky/Microsoft reporting. Individual sub-cluster boundaries (Lazarus vs. APT38/BlueNoroff) carry moderate analyst-to-analyst variance.

## Targeting
- **Sectors:** financial services and banks (SWIFT endpoints, ATM switch infrastructure), cryptocurrency exchanges / blockchain / DeFi / Web3 and crypto-related software, defense and aerospace, government, media/entertainment, energy, gaming, and IT/DevOps personnel at high-value firms.