RH DOSSIER / Cyber network / contractor
Lazarus Group
- Purpose
- A North Korean cyber network associated with espionage, destructive attacks and financial theft. Revenue-generating operations help support the regime, including its weapons programs, according to Treasury. [25]
- Size and reach
- No reliable Lazarus-specific headcount in the cited records. Its operations reach multiple countries and industries; estimates for North Korea’s entire cyber workforce should not be assigned to this group. [25][26]
- Why this alignment
- Treasury identifies it as controlled by the Reconnaissance General Bureau. It is a concealed instrument of the North Korean state rather than an independent foreign militia. [25]
01 / STATE RELATIONSHIP
Reconnaissance General Bureau (RGB)
Treasury identifies Lazarus as controlled by the RGB. An FBI statement links TraderTraitor-affiliated actors, also described there as Lazarus and APT38, to cryptocurrency theft.
Where the evidence stops
Included as a state-controlled comparison, not an independent militia. Vendor labels overlap and evolve; aliases and subgroups are not counted as separate forces.
The cited dates establish the scope of this record. They do not confirm current operational capacity, complete membership or a present-day legal designation.
PUBLIC RECORD
Sources
- Sanctions on RGB-controlled North Korean cyber groups ↗
U.S. Treasury · 2019-09-13
- FBI attribution of stolen cryptocurrency to DPRK actors ↗
Federal Bureau of Investigation · 2023-08-22