Ep. 94 - Lazarus Group Is Six North Korean Clusters, and One of Them Rented Qilin Ransomware

Sekoia and Kudelski Security’s “Beyond Lazarus” report splits North Korea’s Lazarus Group into six clusters with different mandates, from TEMP.Hermit and CryptoCore to Moonstone Sleet and Famous Chollima.

Host Tova Dvorin and SafeBreach’s Adrian Culley map the two agencies behind Pyongyang’s hacking, why a state unit used Qilin ransomware-as-a-service, how Kimsuky and Reaper differ, and three fixes: retire the composite Lazarus threat profile, test what a fake IT worker’s credentials can reach, and merge your APT and ransomware test plans.

00:00 – Is Lazarus Really One Threat Group?

01:40 – Who Controls North Korea’s Cyber Operations?

06:19 – The Six Threat Clusters Behind Lazarus

07:30 – When Nation-State Hackers Use Ransomware-as-a-Service

11:00 – How Cybercrime Funds North Korea’s Operations

13:28 – Three Actions Security Teams Should Take Now

#cybersecurity #infosec #CISO #LazarusGroup #NorthKorea #ThreatIntelligence #FamousChollima #BreachAndAttackSimulation