“Lazarus Hackers Group” No Longer Refer to a Single APT Group But a Collection of Many Sub-Groups

**Executive summary:** The report explains that the term “Lazarus Group” now represents a network of specialized sub‑groups (e.g., APT38, Bluenoroff, Moonstone Sleet, Citrine Sleet) with overlapping TTPs and diverse objectives—ranging from cryptocurrency theft to ransomware—complicating attribution and necessitating subgroup‑level analysis for targeted alerts and defenses.