North Korea's Lazarus umbrella operates as six distinct cyber clusters, according to a new analysis of the country's offensive cyber capabilities.
Sekoia and Kudelski Security said the organization reflected a broader effort by North Korea to distribute cyber operations across units focused on espionage, financial activity and sanctions evasion.
The research, published on September 7, categorized the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.
Lazarus Umbrella Divided Into Six Clusters
The researchers said North Korean cyber units had been repeatedly reorganized and renamed, complicating attribution and making the country's cyber structure difficult to map. Most of the threat actors examined sit under the GRIB, North Korea's main military intelligence bureau, formerly known as the RGB.
Sekoia and Kudelski Security said their latest clustering was based on tactics, techniques and procedures (TTPs) and the types of operations conducted by each group. Famous Chollima was distinguished by activity linked to fake IT workers, which the researchers said often supported the objectives of other cyber units.
Among the six, Moonstone Sleet combined cyberespionage with financially motivated operations, using its own custom malware alongside the Qilin ransomware-as-a-service (RaaS) platform. The researchers said a separate DPRK-nexus cluster, Andariel, followed a similar dual-mandate pattern.
The researchers also said the former APT38 cluster had likely split into CryptoCore and Jade Sleet, which they said were now focused on financial campaigns targeting cryptocurrency, Web3 and blockchain organizations.
IT Workers Extend the Cyber Operation
Alongside the APT clusters, North Korea's cyber capability included thousands of IT workers operating under false identities, according to the report.
Sekoia and Kudelski Security said these workers generated revenue for the regime while gaining access to organizations through legitimate employment. In some cases, workers queried internal corporate documentation or used access obtained through remote consulting roles to conduct further activity.
The report separately linked fake IT workers to direct cryptocurrency theft, including a $62.5m exploit of the Munchables protocol. It added that the IT worker program served both financial and operational purposes. Salaries were remitted to North Korea to help circumvent sanctions, while access obtained through employment could also support financial theft or espionage.
The wider ecosystem included front companies, educational institutions and third-country infrastructure in places including China, Russia, Southeast Asia and Africa. These networks provided operational cover, access and mechanisms for moving illicit funds.
Sekoia and Kudelski Security said the distinction between espionage and revenue generation is less firm than it appears.