North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security's analysis finds North Korea's Lazarus umbrella split into six clusters (TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima) that mix espionage and financially motivated operations; Moonstone Sleet and related DPRK clusters leverage custom malware and the Qilin RaaS, while an extensive program of fake IT workers, front companies and third-country infrastructure supports access, cryptocurrency theft (including a linked $62.5M exploit) and sanctions evasion.