Lazarus Group: North Korea’s Cyber Operations, Attacks, and Tactics

Last updated: July 14, 2026 · Research verified through: July 14, 2026

Lazarus Group is a public threat-intelligence label for North Korean state-linked cyber activity. Governments and security researchers have attributed operations under this name to the country’s Reconnaissance General Bureau, while reported objectives span espionage, financial theft, disruption, and strategic access. The label is imprecise: sources divide North Korean operators differently, and not every DPRK-linked intrusion is Lazarus Group activity. This guide explains the evidence, major campaigns, recurring behaviors, and defensive priorities without treating overlapping names as interchangeable.

Important attribution note. Threat-actor names are analytical labels, and different sources may split or combine the same activity. An alias can represent a government label, vendor cluster, subgroup, campaign, or public persona. The article therefore retains each source’s wording, date, and material caveats.

Executive summary

• MITRE ATT&CK describes Lazarus Group as a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau and active since at least 2009.
• Public reporting uses “Lazarus Group” both for a broad umbrella and for narrower clusters. HIDDEN COBRA, Diamond Sleet, BlueNoroff, Andariel, TraderTraitor, and Guardians of Peace are not universally interchangeable names.
• Reported operations combine intelligence collection, long-term access, disruptive attacks, bank and cryptocurrency theft, and targeting of defense, technology, software, and research organizations.
• Social engineering is a recurring access path. Public campaigns have used recruiter or employer impersonation, tailored professional approaches, collaboration services, and work-themed files to reach developers and cryptocurrency personnel.
• Cryptocurrency risk is not limited to a wallet exploit. Employee identity, developer endpoints, cloud accounts, transaction systems, and approval workflows can all become part of the attack path.
• The public toolset spans Windows, macOS, and Linux malware, along with legitimate utilities and services. A malware name or ATT&CK technique alone is not enough to attribute an incident.
• Defenders need correlated identity, endpoint, email, cloud, source-control, CI/CD, network, and financial telemetry. Durable detections focus on behavior and context rather than copied indicator lists.
• No single product or assessment can prove an organization is “Lazarus-proof.” The practical goal is to reduce exploitable trust, limit privilege, strengthen financial approvals, and rehearse containment and recovery.

Quick answer: What is the Lazarus Group?

Lazarus Group is a widely used name for North Korean state-linked cyber operations associated in public reporting with espionage, destructive activity, strategic access, bank theft, and cryptocurrency theft. The current MITRE ATT&CK profile attributes the group to North Korea’s Reconnaissance General Bureau and notes that “Lazarus Group” is often used as an umbrella for several operators that may share personnel, infrastructure, malware, and tradecraft. That matters because public labels do not map cleanly: a government advisory may use a broad DPRK label, while a vendor tracks a narrower cluster or campaign. Responsible analysis therefore separates incident facts, technical clustering, and sponsor attribution and does not assume every North Korean operation belongs to Lazarus.

Key defensive priorities

• Verify unusual recruiter or job approaches out of band and inspect unfamiliar files in an isolated, non-privileged environment.
• Use phishing-resistant MFA, device-bound access, short-lived credentials, and a tested session and key revocation process.
• Protect developer endpoints, source control, CI/CD, dependencies, code signing, and release approvals as one trust chain.
• Separate transaction creation, approval, signing, and wallet custody; require independent approval for high-impact transfers.
• Centralize identity, endpoint, cloud, collaboration, repository, network, and financial logs before an incident occurs.

Lazarus Group at a glance

Who is the Lazarus Group?

In public threat intelligence, “Lazarus Group” is best understood as an attribution container rather than a precise corporate-style organization. MITRE’s May 2026 update says the name is often used as an umbrella for multiple North Korean operators conducting espionage, destructive attacks, and financially motivated campaigns. It also notes that units can share personnel, infrastructure, malware, and tradecraft as national priorities change. Those overlaps help analysts connect campaigns, but they also make a clean organizational boundary difficult to defend.

Government and vendor reports can differ without contradicting one another. A government may use a broad DPRK label, while a vendor tracks a narrower cluster or campaign. Those labels reflect different evidence, thresholds, and collection periods.

The public record spans destructive impact at Sony Pictures, attempted financial-transfer abuse at Bangladesh Bank, WannaCry disruption, cryptocurrency theft, and recruitment or supply-chain campaigns targeting technology and defense communities.

Reducing Lazarus to a malware family would therefore be misleading. Tooling changes, malware names can be vendor-specific, and legitimate utilities may appear alongside custom implants. Reducing it to cryptocurrency theft is also incomplete: the umbrella’s public history includes intelligence collection, destructive activity, and access to strategically valuable organizations. Readers who need broader context on state-sponsored hacking groups should treat the Lazarus label as one example of a wider attribution problem not as a benchmark for ranking actors.

Is Lazarus Group connected to North Korea?

Multiple governments have publicly linked Lazarus-related activity to North Korea. MITRE attributes G0032 to the Reconnaissance General Bureau. On September 13, 2019, the U.S. Treasury sanctioned Lazarus Group, Bluenoroff, and Andariel, describing them as North Korean state-sponsored malicious cyber groups controlled by the RGB. The U.S. Department of Justice’s 2018 complaint alleged that a North Korean programmer participated in a Lazarus-linked conspiracy involving Sony Pictures, Bangladesh Bank, WannaCry, and other targets. A 2021 superseding case expanded the allegations against three RGB-linked programmers.

The United Kingdom has also issued actor-level assessments. In December 2017, the UK government said the National Cyber Security Centre assessed it was highly likely Lazarus was behind WannaCry. That wording is important: “highly likely” communicates an assessment, not direct courtroom proof.

Official attribution may combine technical evidence, intelligence, infrastructure analysis, victimology, and policy judgment. Technical clustering is narrower. Sanctions are executive actions, while complaints and indictments contain allegations that should remain described as allegations unless adjudicated.

Accordingly, the article separates incident facts, technical clustering, and sponsor attribution. Defenders still need to contain the intrusion even when actor attribution remains incomplete.

Lazarus Group names, aliases, and related clusters

The following table is a crosswalk, not a declaration that every row is an exact synonym.

Figure 1. Public reporting uses overlapping but non-identical names for Lazarus-related activity. Relationships should be interpreted according to the source and date. Sources: MITRE ATT&CK G0032/G0082/G0138, U.S. Treasury (2019), Microsoft threat-actor naming (2026), and Mandiant (2023–2024).

Groups that should not automatically be treated as Lazarus

Kimsuky is a separately tracked DPRK espionage actor. MITRE G0094 lists names including APT43 and Emerald Sleet, but it does not make Kimsuky an alias for Lazarus Group. Similarly, MITRE G0067 tracks APT37 with ScarCruft among its associated names. Shared sponsorship, geography, target interest, or even technique overlap does not collapse these clusters into one actor.

North Korean remote IT-worker fraud is another important boundary. The scheme can involve people obtaining employment under false identities to generate revenue and, in some cases, gain access or steal data. It is a serious enterprise and supply-chain risk, but it should not be labeled Lazarus without incident-specific evidence. DeepStrike’s separate guide to North Korean remote IT-worker schemes covers that intent without conflating it with this actor profile.

For newly named DPRK clusters, retain the source’s original label, date, and confidence instead of normalizing every operation into “Lazarus.”

What are Lazarus Group’s objectives?

The public record supports several coexisting objectives:

Espionage and strategic intelligence. Campaigns linked to defense, aerospace, technology, researchers, and governments can seek sensitive technical or policy information. Access to developers and source repositories can reveal intellectual property, product roadmaps, credentials, and downstream trust relationships.

Financial theft and revenue generation. Public cases include bank-transfer fraud and cryptocurrency theft. Treasury’s 2019 designation described BlueNoroff as focused on overseas financial institutions to generate revenue for the North Korean government. An operation aimed at funds can still include lengthy reconnaissance, credential access, and lateral movement.

Disruption and coercion. Sony Pictures and WannaCry illustrate destructive or disruptive effects attributed to North Korean activity. The operational objective may include reputational pressure, denial of service, data destruction, or broad impact rather than quiet collection.

Long-term access. A foothold in a technology company, cloud tenant, software provider, or developer environment can provide intelligence today and optional access later. Supply-chain compromise is strategically valuable because one trusted delivery path may reach multiple organizations.

Cryptocurrency acquisition. Digital assets offer speed, global reach, and targets whose business processes include direct asset custody. But “crypto theft” is an outcome, not one technique. Reported cases have involved social engineering, employee access, software trust, cloud or identity compromise, and transaction manipulation.

Objectives can overlap and change. Defenders should model the outcome relevant to their assets rather than assume one fixed, financially motivated playbook.

Who does Lazarus Group target?

Victimology supports an assessment but does not prove it. Analysts still need the technical timeline, infrastructure, malware, identity activity, and source reporting.

Major Lazarus Group attacks and campaigns

The timeline separates official attribution, legal allegations, and multi-source technical assessments. Each row preserves the source-level caveat.

Figure 2. Selected Lazarus-related incidents based on publicly available attribution, with confidence and source type shown separately. Amounts are omitted from the visual. Sources: FBI, DOJ, UK NCSC, U.S. Treasury, CISA, and MITRE ATT&CK.

The incidents illustrate different risks: destructive impact, payment-process compromise, widespread disruption, abuse of professional trust, and attacks on asset custody and approval workflows.

The timeline is not a claim that one team, one intrusion chain, or one malware family executed every operation. It is a selection of cases with direct public attribution. DeepStrike’s analysis of North Korean cryptocurrency operations owns the detailed loss and tracing intent; this article retains only the context needed to understand the Lazarus entity.

How Lazarus Group operations typically develop

Lazarus-related operations do not follow one sequence. The lifecycle below is a set of defensive possibilities, not a universal intrusion playbook:

1. Target research. Operators may study an organization, employee roles, professional networks, suppliers, software, or financial processes.
2. Trust building or social engineering. A persona, recruiter approach, business conversation, or compromised relationship may make later content appear credible.
3. Initial access. Reported paths include phishing, links or files delivered through services, trojanized applications, exposed software, or trusted third-party distribution.
4. Execution or malware delivery. User action or a compromised software path can start an implant or script. Defenders should focus on the process chain and origin rather than reproduce the execution method.
5. Credential and identity access. Sessions, tokens, passwords, browser data, or application credentials may become more valuable than the first endpoint.
6. Persistence or continued access. Campaigns may seek recurring endpoint, cloud, application, or account access. The mechanism varies by platform and operation.
7. Discovery and lateral movement. The actor may identify users, hosts, repositories, cloud services, payment systems, or other high-value resources.
8. Collection or financial access. Espionage operations collect data; theft operations position access around approvals, keys, transaction systems, or asset custody.
9. Exfiltration, theft, or disruption. Outcomes can include data removal, unauthorized transfer, public release, service disruption, or destructive impact.
10. Infrastructure change or attempted re-entry. External infrastructure and access methods can rotate. Containment that addresses only the first malware sample may leave identity or third-party access intact.

Use the lifecycle to frame questions: what executed, which identities were used, what resources were reached, and whether the evidence matches a known campaign.

The Lazarus Attribution-to-Defense Model

The Lazarus Attribution-to-Defense Model is a DeepStrike framework for converting public reporting into testable defensive questions. It is not an industry standard or an attribution score.

Its five layers record the attribution source, likely objective, exposed attack surface, observed behavior, and defensive evidence needed to validate or reject the working hypothesis.

Figure 3. The DeepStrike Lazarus Attribution-to-Defense Model links public reporting to the telemetry and controls defenders can validate. Example paths are defensive hypotheses, not fixed campaign sequences.

A fake-recruiter report should trigger review of the developer endpoint, identity sessions, collaboration history, and source-control events. Cloud, cryptocurrency, and supply-chain cases should similarly connect the suspected behavior to protected audit, approval, build, signing, and release evidence.

A government statement can support sponsor attribution, while EDR or identity logs establish behavior in the incident. Record those conclusions separately.

Lazarus Group tactics and MITRE ATT&CK techniques

The MITRE ATT&CK Lazarus Group entry contains a broad set of mappings accumulated across campaigns and years. The following selection emphasizes recurring behaviors with practical defensive value; it is not a checklist that every intrusion will exhibit.

ATT&CK describes behavior; it does not prove attribution. Technique matches become useful only when they align with the incident’s timing, victimology, infrastructure, and technical evidence.

Social engineering and fake job campaigns

Recruiter and employer impersonation borrows a legitimate workflow. Public reporting describes tailored roles, professional-network contact, interview tasks, and movement to messaging or collaboration services often aimed at developers and cryptocurrency personnel with privileged access.

The FBI’s September 2024 advisory warned that DPRK actors conduct highly tailored social engineering against employees in decentralized-finance and cryptocurrency businesses. The DMM Bitcoin attribution later described a recruiter-themed approach that ultimately enabled impersonation and manipulation of a transaction request. These cases show why awareness training alone is insufficient: the workflow can span weeks and use channels outside the corporate email gateway.

Verify unusual recruiters and professional requests through an independently obtained channel. Review unfamiliar projects in isolated, non-privileged environments; keep production secrets and signing access off test systems; use phishing-resistant MFA; protect source control; and provide a low-friction reporting path.

Cryptocurrency and blockchain operations

Cryptocurrency organizations combine high-value assets, globally connected infrastructure, software-heavy workflows, and employees with direct or indirect custody privileges. Relevant surfaces include identities, cloud accounts, source code, build systems, signing, transaction creation, and wallet approval.

Keep three evidence types separate: intrusion evidence explains access, attribution evidence links activity to a cluster or sponsor, and blockchain tracing follows assets. A transaction path alone does not prove the intrusion method or operator.

Loss figures also change meaning over time. An attempted transfer is not necessarily a completed theft; stolen assets may later be frozen or recovered; valuations change; and annual estimates can overlap. This article therefore includes only incident amounts stated directly by authoritative sources where they materially identify the event. It does not aggregate them. Readers seeking totals and methodology should use the dedicated DeepStrike coverage of crypto crime trends and North Korean cryptocurrency operations.

Do not assign every DPRK-linked cryptocurrency theft to Lazarus. Public sources use labels such as TraderTraitor, APT38, BlueNoroff, Slow Pisces, and Jade Sleet with different boundaries; preserve the attributing source’s label.

Malware and tooling associated with Lazarus Group

This is a selected set, not a malware catalogue. Tools and infrastructure change, and some names describe delivery applications or campaign-specific families. A hash or domain may identify only one sample or infrastructure period.

Prefer behavior-based detection that correlates provenance, process ancestry, identity context, persistence, and network activity. Use static indicators only with dates and source context.

Windows, macOS, cloud, and developer ecosystem risk

For Windows endpoints, collect process creation, script and command-line telemetry, file origin, service or task changes, security-control events, and identity context. Baselining and process lineage help distinguish legitimate administration from abuse.

Treat developer Macs as managed enterprise assets. Enforce supported versions, EDR, application trust, browser and identity controls, secrets hygiene, and restricted production access.

Cloud identities can outlive the first affected endpoint. Review authentication, token use, role assignments, applications, storage access, and conditional-access decisions before closing the incident.

Developer ecosystems expand the evidence surface. Source-control events, package registry access, CI/CD worker logs, artifact provenance, secret scanning, code-signing systems, branch protection, release approvals, and dependency changes all matter. Microsoft’s 2023 Diamond Sleet report described a compromised software supply chain that distributed a modified installer, underscoring the need to monitor both producer and delivery paths.

Remote work can connect personal social accounts, messaging services, corporate endpoints, SSO, repositories, and cloud systems. Incident plans should support lawful evidence collection across those transitions.

Living-off-the-land and legitimate tool abuse

Living off the land means abusing capabilities already present in the environment or otherwise legitimate software. Native interpreters, system binaries, remote services, and cloud services are not suspicious by presence alone.

Detection should therefore combine context. Ask who launched the process, from which parent, under what device and identity state, with which file origin, toward what destination, and after which earlier event. An unusual signed binary reaching the network after a recruiter-delivered file has different significance from the same binary launched by approved management software. DeepStrike’s guide to living-off-the-land techniques explains the concept in depth; this page focuses on its relevance to Lazarus-related defense.

How to detect Lazarus Group activity

Detection is an evidence-integration problem. No single alert, domain, wallet, malware name, or ATT&CK technique confirms Lazarus attribution.

High-confidence detection combines behavior, context, infrastructure, malware analysis, victimology, and time. Preserve negative evidence too: expected automation may refute an alert, while a routine valid-account event can become high priority after a tailored approach and sensitive access.

Defensive controls mapped to observed behavior

Controls reduce probability and impact; they do not guarantee prevention. Prioritize independent approval for high-impact actions, protected telemetry, and rehearsed access revocation.

Incident response: what to do when Lazarus-related activity is suspected

1. Preserve volatile and identity evidence. Capture the relevant endpoint, memory, active sessions, identity-provider records, cloud audit trails, collaboration history, repository events, and financial logs according to the organization’s legal and forensic procedures.
2. Activate the incident-response plan. Assign an incident lead, establish a secure communications channel, and separate confirmed facts from working attribution.
3. Isolate affected systems carefully. Contain confirmed or high-risk endpoints and access paths while considering business continuity and evidence preservation.
4. Revoke compromised sessions and credentials. Rotate passwords, tokens, keys, application secrets, and signing access based on the established scope not just the first user account.
5. Review cloud and source-control access. Examine role changes, tokens, clones, workflow edits, releases, integrations, and secrets exposure.
6. Protect financial and cryptocurrency workflows. Pause or add independent review to high-risk transfers; secure transaction creation, approval, signing, and wallet operations.
7. Investigate related accounts and devices. Look for shared personas, messages, infrastructure, process patterns, identity sessions, and access to the same sensitive resources.
8. Engage external obligations and contacts. Coordinate legal, privacy, regulatory, insurance, specialist response, and law-enforcement contacts where appropriate to the jurisdiction and impact.
9. Validate containment. Confirm that endpoint, identity, cloud, third-party, repository, and financial access paths are closed and that clean systems do not inherit compromised secrets.
10. Monitor for re-entry. Heighten monitoring around the affected users, suppliers, domains, repositories, cloud resources, and financial controls.
11. Record attribution confidence separately. Maintain a timeline of incident facts, technical cluster assessment, and sponsor attribution with source dates and confidence.

Adapt containment to the organization and preserve evidence. Do not delay urgent action merely to prove the actor name; business impact and access scope come first.

Lazarus Group versus other DPRK-linked actors

This is not an actor ranking. The practical question is which source-defined cluster and objective best fit the evidence.

Common misconceptions

Every North Korean cyberattack is Lazarus Group. Public reporting tracks multiple DPRK clusters and schemes. Preserve the source’s label and scope.

Every alias is interchangeable. HIDDEN COBRA, Diamond Sleet, TraderTraitor, Guardians of Peace, BlueNoroff, and Andariel represent different taxonomies or scopes.

Lazarus only steals cryptocurrency. Public attribution also covers espionage, bank theft, strategic access, destructive attacks, and disruption.

Lazarus uses one fixed malware toolkit. Tools, platforms, delivery paths, and infrastructure change across operations.

Static indicators provide permanent detection. Hashes, domains, accounts, certificates, and wallets are time-bounded evidence.

A famous attribution proves later allegations. Every incident needs its own evidence, source, date, and confidence.

One security product can stop a state-sponsored actor. Prevention, detection, approvals, segmentation, logging, and response readiness must work together.

Penetration testing can certify an organization as Lazarus-proof. Testing validates a defined scope and time; it cannot guarantee resistance to a changing actor.

ATT&CK technique overlap proves actor identity. Common techniques are shared by many actors and legitimate administrators.

Every developer-targeting campaign is Lazarus. A lure theme is an investigative lead, not an attribution conclusion.

What security leaders should prioritize

Cryptocurrency organizations: isolate high-value roles, protect employee and developer identity, segregate wallets, require independent transaction verification, centralize approval evidence, and rehearse a rapid freeze process.

Financial institutions: segment payment environments, constrain privilege, monitor message creation and approval separately, and test response decisions for attempted, blocked, completed, and recovered transfers.

Software and developer teams: manage endpoints; keep production secrets out of interview or test environments; protect repositories, CI/CD, signing, registries, dependencies, and release approvals.

Cloud-first organizations: treat identity as the control plane with phishing-resistant MFA, device posture, least privilege, protected logging, service-principal governance, and tested token revocation.

Defense and research organizations: map sensitive programs to people, repositories, suppliers, and endpoints; support safe reporting of unusual professional approaches; monitor high-value identities.

General enterprises: identify paths that combine external trust, privilege, sensitive data, software delivery, and financial authority. Reduce, instrument, and test those paths.

Frequently asked questions

What is the Lazarus Group?

Lazarus Group is a public label for North Korean state-linked cyber activity associated with the Reconnaissance General Bureau. Reported operations include espionage, financial theft, strategic access, disruption, and destructive activity. MITRE notes that the name is often used as an umbrella, not one fixed team.

Is Lazarus Group part of the North Korean government?

U.S. Treasury and MITRE attribute Lazarus Group to North Korea’s Reconnaissance General Bureau, and U.S. and UK agencies have made public attributions in major cases. Open reporting does not provide a complete organizational chart, so sanctions, legal allegations, and technical assessments should remain distinct.

What other names are used for Lazarus Group?

Associated names include Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, and Diamond Sleet. Reporting also connects BlueNoroff/APT38, Andariel, and TraderTraitor to parts of the activity. These labels may represent different government, vendor, subgroup, campaign, or persona scopes.

Are BlueNoroff and Andariel the same as Lazarus Group?

Not exactly. U.S. Treasury described BlueNoroff and Andariel as Lazarus subgroups in 2019, while MITRE and vendors also track them as distinguishable clusters. Retain the original source’s taxonomy rather than replacing every label with “Lazarus Group.”

What attacks has Lazarus Group been linked to?

Public sources link Lazarus-related activity to Sony Pictures, Bangladesh Bank, WannaCry, Operation Dream Job, Ronin, Horizon Bridge, and other cryptocurrency incidents. Later DMM Bitcoin and Bybit statements used the narrower TraderTraitor label, so each case needs its own source and caveat.

Was Lazarus Group responsible for WannaCry?

The UK government said the NCSC assessed it was highly likely Lazarus was behind WannaCry. A 2018 U.S. Department of Justice complaint also alleged North Korean involvement. Those qualified terms should not be rewritten as proof of every operational detail.

Why does Lazarus Group target cryptocurrency companies?

Cryptocurrency businesses combine transferable assets with cloud, software, signing, wallet, and approval systems. Public reporting connects several DPRK clusters to this objective; blockchain tracing alone does not explain the original intrusion or prove that every case is Lazarus.

What malware does Lazarus Group use?

MITRE and government reporting associate Lazarus-related activity with tools such as AppleJeus, BLINDINGCAN, Dacls, ThreatNeedle, DRATzarus, Dtrack, and the historical WannaCry outbreak. Tooling changes across campaigns, so behavior, provenance, and context matter more than a static family list.

How does Lazarus Group gain initial access?

Reported access paths include tailored phishing, fake employment themes, social or collaboration services, trojanized applications, compromised software delivery, and exploitation in some campaigns. There is no single entry method; defenders should focus on trust, identity, file origin, endpoint behavior, and software provenance.

How can organizations detect Lazarus Group activity?

Correlate identity, collaboration, endpoint, network, cloud, source-control, CI/CD, package, and financial telemetry. Look for a coherent sequence rather than one IOC or ATT&CK technique; attribution also requires infrastructure, malware, victimology, timing, and source context.

How can companies reduce their exposure?

Prioritize phishing-resistant MFA, least privilege, managed developer endpoints, application control, EDR, protected cloud and repository logs, secure build controls, segmentation, independent financial approvals, wallet segregation, and rehearsed incident response. These controls reduce likelihood and impact but do not guarantee prevention.

Is every North Korean cyberattack carried out by Lazarus Group?

No. Public reporting separately tracks Kimsuky/APT43, APT37/ScarCruft, Andariel/APT45, BlueNoroff/APT38, other clusters, and remote IT-worker schemes. Sponsorship, target similarity, or shared techniques do not establish exact actor identity.

Conclusion

Lazarus Group remains important because public attribution connects the label with espionage, disruption, financial theft, and access to valuable technology ecosystems. Because taxonomies overlap, defensible analysis must preserve the source, date, evidence, and confidence.

Security leaders should protect identity, developer endpoints, cloud control planes, source and build systems, third-party trust, and financial approvals and rehearse access revocation, transaction pauses, containment validation, and re-entry monitoring.

No single security assessment can guarantee protection from Lazarus Group or any other state-sponsored actor. Where it fits an organization’s risk model, DeepStrike’s verified penetration testing services can help test scoped web, API, cloud, network, mobile, and internal attack paths and support remediation validation. The result should be treated as evidence about the tested scope and time not as certification against a named adversary.

Author and review information

Author: Mohammed Khalil, CISSP, OSCP, OSWE
Last reviewed: July 14, 2026
Research verified through: July 14, 2026

Actor naming and attribution can change as new evidence appears. Recheck primary sources before future material updates.