Lazarus Group’s Operations Divided Into Six Separate Cyber Units, Researchers Find

Cyber‑security firms Sekoia and Kudelski Security have identified that North Korea’s notorious Lazarus hacking umbrella now functions through six distinct operational clusters, each concentrating on specific illicit activities such as espionage, financial theft and sanctions evasion.

The analysis, first detailed in Infosecurity Magazine, shows the groups are compartmentalized to limit cross‑contamination and to streamline their varied objectives. One cluster appears dedicated to intelligence‑gathering, targeting diplomatic and governmental networks, while another focuses on extracting funds from cryptocurrency exchanges and illicit online banking schemes.

Two additional clusters are reportedly tasked with bypassing international sanctions, employing sophisticated money‑laundering techniques and leveraging shell companies to move proceeds out of the country. The remaining units specialize in ransomware deployment and supply‑chain infiltration, expanding the group’s reach beyond traditional state‑sponsored espionage.

According to the researchers, the segmentation reflects a strategic evolution designed to increase operational resilience. By isolating activities, a compromise of one cluster—through law‑enforcement action or technical countermeasures—does not automatically expose the others, preserving the overall capability of the Lazarus umbrella.

Experts note that this structural shift aligns with broader trends among nation‑state cyber actors, who are adopting more modular approaches to reduce attribution risk and improve adaptability. The findings also underscore the persistent threat posed by North Korean cyber operations, which have funded a significant portion of the regime’s budget despite crippling sanctions.

Authorities in several jurisdictions have already increased scrutiny of cryptocurrency platforms and financial institutions suspected of facilitating illicit transfers linked to Lazarus. The new intelligence may prompt further coordinated international efforts, including tighter sanctions enforcement and enhanced information‑sharing among cyber‑defense agencies.

While the precise identities of the six clusters remain undisclosed, the report provides a clearer map of Lazarus’s internal architecture, offering a valuable reference point for defenders seeking to disrupt its illicit activities. As cyber‑defense communities digest the findings, the next steps will likely involve refining detection signatures and expanding collaborative investigations to dismantle the group’s financial pipelines.