Beyond Lazarus: How North Korea Organizes Its Cyber Operations

This joint Sekoia–Kudelski report analyzes DPRK offensive cyber capabilities as an integrated state strategy: mapping institutions (GRIB, NIA, KWP), APT clusters (Lazarus sub-clusters, Andariel, Reaper, CryptoCore/Jade Sleet), the use of sanctioned IT-worker programs and front companies for revenue generation and espionage, and associated TTPs and laundering networks that enable large-scale cryptocurrency thefts and financially-motivated campaigns.