Beyond Lazarus: Organization of DPRK Cyber Capabilities

This joint research by Kudelski Security and Sekoia analyzes the DPRK’s offensive cyber apparatus, showing that Pyongyang treats cyber operations as a strategic, deniable tool for regime survival, sanctions evasion, and revenue generation. The report maps institutional responsibilities (GRIB, NIA, KWP), decomposes the Lazarus umbrella into six sub-clusters focused on espionage and lucrative theft (crypto, banks, ransomware), details the global IT-worker program and third‑country relays used for operations and money‑laundering, and highlights the evolving TTPs that sustain DPRK cyber campaigns.