Threat actor
Lazarus Group
Tracked by CyberSIXT since 21 Apr · last activity 21 Oct
- CVEs linked · all time
- 5
- in CISA KEV · all time
- 2
- articles · all time
- 27
2 articles since 11 Sep.
Show as table
| Day (UTC) | Articles |
|---|---|
| Wed 21 Oct | 2 |
CVEs
5 CVEsCVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVSS9.9CriticalExploited99%EPSS5articles
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVSS7.0HighExploited0.3%EPSS17articles
CVE-2026-62893Microsoft Windows Server 2012 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS2articles
CVE-2026-62832Microsoft Windows 10 Version 21H2 vulnerabilityCVSS7.8High–Not in KEV0.4%EPSS6articles
- Lazarus Targets South Korean Firms Through Fake CV WebsitesSecurityOnline
- Lazarus Group abuses South Korean security software in FlashHole campaignSecurelist
- Researchers Map Lazarus Into Six North Korean Cyber UnitsInfosecurity
- North Korean Hackers Trojanised HAProxy to Alter Selected Web PagesThe Hacker News
- Lazarus Group exploits CVE‑2026‑68820 via fake job offersSecurity Affairs
- Lazarus Used Post-Quantum Key Exchange to Deliver Zero-DayInfosecurity
- MS Patch Tuesday patches 421 flaws, Lazarus zero day exploitedMalwarebytes
- Lazarus uses fake job offers to exploit Windows CVE-2026-68820SecurityWeek
- Lazarus Exploits Windows Zero-Day in Operation Dream Job AttacksSecurityOnline
- Lazarus hits defence via fake job PDFs, CVE-2026-68820Check Point
- Lazarus NullReceiver malware uses npm Ethereum queries for C2Infosecurity
- North Korean Hackers Hijack NPM Packages via Social EngineeringSecurityOnline
- Lazarus shares tools with Gunra ransomware in South Korea attacksDataBreaches
- North Korean Hackers Exploit Fake Zoom Calls to Steal Crypto DataSecurityOnline
- BlueNoroff Zoom Phishing Kit Hits Crypto Wallets With ProfilingThe Hacker News
- Lazarus-Linked npm Malware Masquerades as Rollup PolyfillsSecurityOnline
- Ghost CMS mass hack via CVE-2026-26980 fuels ClickFix attack waveSecurity Affairs
- North Korean hackers deploy memory only toolset against banksSecurityOnline
- Lazarus Uses Fileless RemotePE RAT Powered by DPAPI LoaderSecurity Affairs
- Lazarus Group Deploys Memory Only RAT Against Crypto and BanksThe Hacker News
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- Lazarus Exploits Fake Interviews to Steal Developer Credentialsdti.domaintools.com
- North Korea’s BlueNoroff uses fake Zoom to steal crypto exec dataDark Reading
- North Korean hackers use fake Zoom links to steal crypto walletsInfosecurity
- Lazarus Group targets macOS users with ClickFix fake meeting scamDark Reading
- North Korea linked hackers steal $290M from Kelp DAO DeFiSecurityWeek
- Lazarus linked to $293m KelpDAO heist via LayerZero flawInfosecurity · first in our coverage