Lazarus Group: How North Korea-Linked Hackers Have Stolen Billions

Lazarus Group is the umbrella name for North Korean state-run hacking units, which governments attribute to the country's intelligence apparatus. Unlike most state hackers who mainly steal secrets, the group targets money to bypass sanctions that restrict North Korea's access to the banking system. Notable operations include the 2014 Sony Pictures attack, the 2016 Bangladesh Bank heist, the 2017 WannaCry ransomware outbreak, the 2022 Ronin bridge theft, and the 2025 Bybit theft of roughly $1.5 billion. The article notes that these attacks often begin with simple tactics such as fake recruiter offers, poisoned developer packages, and fraudulent remote IT hires. The author advises companies to isolate testing machines, treat unknown code as untrusted, and require delays and multi-person approval for large money transfers.