Skip to content

CyberSIXT Search

Threat actor · coverage timeline

Lazarus Group

28 articles from 11 outlets between 21 Apr and 25 Oct. First reported by Infosecurity. The busiest day was Wed 12 Aug, with 4 articles.

Articles: 28; all time · from 11 outlets
Days with coverage: 21; across 188 days
Busiest day: 4; articles on Wed 12 Aug
Last 7 days: 0.4a day; vs 0.1 a day before
First report: 21 Apr; Infosecurity
CVEs named: 8; 2 in CISA KEV · in these articles

Coverage over time

28 articles · 21 Apr – 25 Oct

21 AprFirst report21 Apr · Infosecurity

Show as table

Lazarus Group: articles per day
Day (UTC)	Articles	Outlets
Tue 21 Apr	2	Infosecurity 1, SecurityWeek 1
Fri 24 Apr	1	Dark Reading 1
Tue 28 Apr	2	Infosecurity 1, Dark Reading 1
Fri 1 May	1	dti.domaintools.com 1
Thu 7 May	1	dti.domaintools.com 1
Mon 25 May	1	The Hacker News 1
Tue 26 May	1	Security Affairs 1
Fri 29 May	1	SecurityOnline 1
Sun 31 May	1	Security Affairs 1
Fri 3 Jul	1	SecurityOnline 1
Fri 24 Jul	1	The Hacker News 1
Thu 30 Jul	1	SecurityOnline 1
Fri 31 Jul	1	DataBreaches 1
Tue 4 Aug	1	SecurityOnline 1
Tue 11 Aug	2	Infosecurity 1, Check Point 1
Wed 12 Aug	4	SecurityOnline 1, SecurityWeek 1, Malwarebytes 1, Infosecurity 1
Thu 13 Aug	1	Security Affairs 1
Fri 4 Sep	1	The Hacker News 1
Mon 7 Sep	1	Infosecurity 1
Wed 21 Oct	2	Securelist 1, SecurityOnline 1
Sun 25 Oct	1	The Hacker News 1

Articles

28 articles

Sun 25 Oct1 article

19:00
PHP2Shell attackers target a European government entityThe Hacker News

Wed 21 Oct2 articles

11:01
Lazarus Targets South Korean Firms Through Fake CV WebsitesSecurityOnline
02:31
Lazarus Group abuses South Korean security software in FlashHole campaignSecurelist

Mon 7 Sep1 article

11:26
Researchers Map Lazarus Into Six North Korean Cyber UnitsInfosecurity

Fri 4 Sep1 article

15:40
North Korean Hackers Trojanised HAProxy to Alter Selected Web PagesThe Hacker News

Thu 13 Aug1 article

08:52
Lazarus Group exploits CVE‑2026‑68820 via fake job offersSecurity Affairs

Wed 12 Aug4 articles

14:11
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-DayInfosecurity
14:11
MS Patch Tuesday patches 421 flaws, Lazarus zero day exploitedMalwarebytes
09:11
Lazarus uses fake job offers to exploit Windows CVE-2026-68820SecurityWeek
03:41
Lazarus Exploits Windows Zero-Day in Operation Dream Job AttacksSecurityOnline

Tue 11 Aug2 articles

17:51
Lazarus hits defence via fake job PDFs, CVE-2026-68820Check Point
15:26
Lazarus NullReceiver malware uses npm Ethereum queries for C2Infosecurity

Tue 4 Aug1 article

09:31
North Korean Hackers Hijack NPM Packages via Social EngineeringSecurityOnline

Fri 31 Jul1 article

13:09
Lazarus shares tools with Gunra ransomware in South Korea attacksDataBreaches

Thu 30 Jul1 article

07:20
North Korean Hackers Exploit Fake Zoom Calls to Steal Crypto DataSecurityOnline

Fri 24 Jul1 article

16:30
BlueNoroff Zoom Phishing Kit Hits Crypto Wallets With ProfilingThe Hacker News

Fri 3 Jul1 article

10:53
Lazarus-Linked npm Malware Masquerades as Rollup PolyfillsSecurityOnline

Sun 31 May1 article

15:31
Ghost CMS mass hack via CVE-2026-26980 fuels ClickFix attack waveSecurity Affairs

Fri 29 May1 article

08:28
North Korean hackers deploy memory only toolset against banksSecurityOnline

Tue 26 May1 article

08:41
Lazarus Uses Fileless RemotePE RAT Powered by DPAPI LoaderSecurity Affairs

Mon 25 May1 article

11:11
Lazarus Group Deploys Memory Only RAT Against Crypto and BanksThe Hacker News

Thu 7 May1 article

23:25
Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com

Fri 1 May1 article

18:41
Lazarus Exploits Fake Interviews to Steal Developer Credentialsdti.domaintools.com

Tue 28 Apr2 articles

22:27
North Korea’s BlueNoroff uses fake Zoom to steal crypto exec dataDark Reading
08:30
North Korean hackers use fake Zoom links to steal crypto walletsInfosecurity

Fri 24 Apr1 article

13:17
Lazarus Group targets macOS users with ClickFix fake meeting scamDark Reading

Tue 21 Apr2 articles

10:21
North Korea linked hackers steal $290M from Kelp DAO DeFiSecurityWeek
08:41
Lazarus linked to $293m KelpDAO heist via LayerZero flawInfosecurity · first report