Mapping MITRE ATT&CK to the DPRK Financial Crime Indictment

This report maps a US Department of Justice indictment of alleged DPRK-linked Lazarus Group actors to MITRE ATT&CK, concentrating on 2015–2019 financially-motivated campaigns that attempted to steal over $1.3 billion from global banks. It details reconnaissance, spear-phishing initial access, user-executed malicious files, defense evasion by masquerading, account discovery and lateral movement to compromise SWIFT endpoints, and highlights the use of custom malware (e.g., Brambul) and ransomware in these operations.