North Korea's Lazarus umbrella split into six cyber clusters
Threat Actor Meta
Summary
Hide ▲
Show ▼
North Korea's Lazarus umbrella has been mapped into six cyber clusters, complicating attribution and separating its espionage and financially motivated operations. The restructuring points to a more distributed operating model across GRIB-linked units and support functions.
Timeline
-
07.09.2026 14:00 2 articles · 2h ago
Lazarus umbrella is mapped into six cyber clusters
Initial DisclosureSekoia and Kudelski Security mapped North Korea's Lazarus umbrella into six distinct clusters — TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima — and said the reorganization reflects a broader North Korean effort to separate espionage, financial activity and sanctions evasion across GRIB-linked units. The analysis also said the former APT38 activity likely split into CryptoCore and Jade Sleet, while Moonstone Sleet combines cyberespionage with financially motivated operations.
Show sources
- North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters — www.infosecurity-magazine.com — 07.09.2026 14:00
- North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters — www.infosecurity-magazine.com — 07.09.2026 14:00