LAZARUS ARISEN

Group-IB's report analyzes the Lazarus APT (linked to North Korea), documenting a shift from DDoS/espionage to financially motivated attacks against banks and SWIFT infrastructures; it describes a modular malware toolset, a three-tier SSL-encrypted C2 architecture (including use of SoftEther VPN), infection vectors (watering-hole sites), identified IoCs (IPs, ports, compromised domains), major incidents such as the 2016 Bangladesh Bank heist, and prescriptive mitigation recommendations for financial organizations.