Lazarus Group statistics trace how this cyber-espionage threat operator evolved from DDoS campaigns in South Korea to destructive wipers and ransomware. The record spans major incidents like the DarkSeoul attack that destroyed 32,000 hard drives and the WannaCry outbreak that spread across 150 countries. Across the page, you’ll explore who is targeted, where activity concentrates, and which tactics and malware families connect the cases.
Key Takeaways
- The Lazarus Group orchestrated the Sony Pictures Entertainment hack in November 2014, leaking over 100 terabytes of data including unreleased films and executive emails.
- Lazarus conducted Operation Troy DDoS attacks against South Korean targets starting in 2011.
- In 2013, Lazarus executed the DarkSeoul attacks destroying 32,000 hard drives at South Korean banks and media companies.
- US Government attributes Lazarus to Reconnaissance General Bureau since 2017.
- FireEye's 2016 report first publicly linked Lazarus to North Korea.
- MITRE ATT&CK profiles Lazarus as G0032 with 50+ techniques.
- The Sony hack resulted in $100 million in damages and lost revenue for Sony Pictures.
- WannaCry caused global economic losses estimated at $4 billion to $8 billion.
- Bangladesh Bank heist netted Lazarus $81 million successfully transferred.
- Lazarus deploys WannaCry ransomware using ETERNALBLUE exploit (CVE-2017-0144).
- Group uses custom malware families like DESTOVER wiper in DarkSeoul.
- SWIFT-compromising malware used in Bangladesh heist called evtdiag.exe.
- Lazarus Group primarily targets financial institutions, governments, and crypto platforms worldwide.
- South Korea has been hit by over 20 Lazarus campaigns since 2011.
- US entities, including Sony and crypto firms, comprise 15% of known Lazarus victims.
Lazarus has repeatedly targeted governments, banks, and crypto worldwide, from Sony to WannaCry and major heists.
Related reading
01 · Category
Attacks And Incidents28 stats
01
The Lazarus Group orchestrated the Sony Pictures Entertainment hack in November 2014, leaking over 100 terabytes of data including unreleased films and executive emails.
02
Lazarus conducted Operation Troy DDoS attacks against South Korean targets starting in 2011.
03
In 2013, Lazarus executed the DarkSeoul attacks destroying 32,000 hard drives at South Korean banks and media companies.
04
The WannaCry ransomware attack attributed to Lazarus infected over 200,000 computers in 150 countries in May 2017.
05
Lazarus hackers stole $81 million from Bangladesh Central Bank via SWIFT network in February 2016.
06
Operation Blockbuster by FireEye linked Lazarus to 11 malware families used in attacks from 2006 to 2016.
07
Lazarus targeted Vietnam Airlines in 2016, stealing 400,000 payment card details.
08
In 2017, Lazarus hit a Polish bank, attempting to steal $1 million via malware.
09
Lazarus conducted cryptocurrency theft from Youbit exchange in South Korea in December 2017, stealing 17% of funds.
10
The group launched the FASTCash campaign targeting ATM networks in 2017.
11
Lazarus stole $625 million from Ronin Network (Axie Infinity) in March 2022.
12
In June 2022, Lazarus compromised Harmony Horizon Bridge for $100 million in crypto.
13
Operation Dream Job saw Lazarus phishing LinkedIn users for crypto jobs in 2022.
14
Lazarus targeted Atomic Wallet users in June 2023, stealing $100 million.
15
The group hit CoinsPaid in July 2023 for $37.3 million.
16
Lazarus stole $41 million from Alphapo in July 2023.
17
TraderTraitor campaign by Lazarus stole $152 million from crypto traders in 2023.
18
In 2014, Lazarus wiped data from South Korean nuclear plant systems.
19
Lazarus used spear-phishing in the 2016 DNC hack precursor activities.
20
The group conducted attacks on cryptocurrency exchanges in 2018, stealing from Bithumb.
21
Lazarus linked to 2020 KuCoin hack of $280 million.
22
In 2021, Lazarus stole from Poly Network $611 million (mostly returned).
23
Operation AppleJeus involved macOS malware for crypto theft starting 2018.
24
Lazarus hit Indian banks in 2017 as part of BlueNoroff campaign.
25
Lazarus Group formed around 2009, active in 70+ countries.
26
Bluenoroff subgroup focused on financial theft since 2015.
27
Andariel subgroup targets South Korean defense since 2021.
28
2023 CoinsPaid attack used social engineering on helpdesk.
Interpretation
Attacks And Incidents Interpretation
Across multiple years of attacks and incidents, the Lazarus Group repeatedly escalated impact, from the DarkSeoul campaign that destroyed 32,000 hard drives in 2013 to the WannaCry outbreak that hit over 200,000 computers in 150 countries in 2017.
02 · Category
Attribution And Analysis24 stats
01
US Government attributes Lazarus to Reconnaissance General Bureau since 2017.
02
FireEye's 2016 report first publicly linked Lazarus to North Korea.
03
MITRE ATT&CK profiles Lazarus as G0032 with 50+ techniques.
04
CrowdStrike names Lazarus as top threat actor in 2023 reports.
05
Chainalysis tracks $600M+ Lazarus crypto thefts since 2022.
06
UN Panel of Experts links Lazarus to 50% of DPRK cyber revenue.
07
FBI indicted Park Jin Hyok in 2018 for Sony and WannaCry.
08
Microsoft Threat Intelligence tracks 9 Lazarus clusters.
09
Mandiant attributes Bluenoroff subgroup to financial ops.
10
Operation Blockbuster by FireEye dismantled Lazarus infrastructure.
11
Symantec confirms Lazarus use of HermitSpy in Middle East.
12
Recorded Future links Lazarus to 170+ domains in 2023.
13
NSA leaked tools like ETERNALBLUE tied to Lazarus exploits.
14
UK NCSC attributes WannaCry directly to Lazarus.
15
Over 80 sanctions by US Treasury on Lazarus members and entities.
16
ESET discovers BluStealer linked to Lazarus in 2023.
17
Google TAG observes Lazarus targeting aerospace/defense.
18
FBI warns of 300% rise in Lazarus crypto activity in 2023.
19
Kaspersky attributes Operation In(ter)ception to Lazarus.
20
Cisco Talos tracks MagicRAT updates by Lazarus.
21
DHS/FBI joint advisory on FASTCash in 2018.
22
SWIFT's customer security programme triggered by Lazarus attacks.
23
CISA adds Lazarus indicators to known exploited catalog.
24
Interpol issues red notices for 11 Lazarus members.
Interpretation
Attribution And Analysis Interpretation
Across Attribution And Analysis, reporting shows a clear consolidation of blame and impact: Lazarus is attributed to North Korea by multiple sources and is tied to $600M+ in crypto thefts since 2022, while UN findings further indicate it accounts for about 50% of DPRK cyber revenue.
03 · Category
Financial Losses24 stats
01
The Sony hack resulted in $100 million in damages and lost revenue for Sony Pictures.
02
WannaCry caused global economic losses estimated at $4 billion to $8 billion.
03
Bangladesh Bank heist netted Lazarus $81 million successfully transferred.
04
Ronin Network hack led to $625 million stolen in Ethereum and USDC.
05
Harmony Horizon Bridge theft amounted to $100 million in multiple tokens.
06
Atomic Wallet hack attributed to Lazarus resulted in $100 million losses.
07
CoinsPaid ransomware attack by Lazarus stole $37.3 million in Bitcoin.
08
Alphapo (Safe) wallet losses from Lazarus reached $41 million in July 2023.
09
Youbit exchange lost 17% of its assets, approximately $6 million, to Lazarus.
10
Bithumb hack in 2018 linked to Lazarus caused $31 million in losses.
11
KuCoin 2020 hack stole $280 million, with Lazarus laundering portions.
12
Poly Network exploit of $611 million, Lazarus suspected in orchestration.
13
Vietnam Airlines lost revenue from stolen 400,000 cards, estimated $10 million impact.
14
Polish bank attack attempted $1 million theft, causing operational downtime costs.
15
DarkSeoul attacks cost South Korean banks millions in recovery.
16
Overall, Lazarus crypto thefts from July 2023 to July 2024 exceeded $200 million.
17
FASTCash campaign enabled $1 million+ ATM cashouts across multiple countries.
18
Operation Blockbuster linked Lazarus to attacks costing victims hundreds of millions.
19
North Korean hackers, including Lazarus, stole $3 billion in crypto since 2017.
20
TraderTraitor stole $152 million from individual traders using fake apps.
21
Sony Pictures incurred $35 million in IT recovery costs alone.
22
WannaCry hit UK's NHS for £92 million in losses.
23
Lazarus-linked attacks on Indian banks prevented larger losses but cost millions in defenses.
24
Bithumb hack led to $18 million immediate loss after 35% token drop.
Interpretation
Financial Losses Interpretation
For the Financial Losses category, Lazarus linked activity shows a pattern of high impact with thefts and damages regularly landing in the $100 million range and escalating further in extreme cases like the Ronin Network hack with $625 million stolen and WannaCry with an estimated $4 billion to $8 billion in global economic losses.
More related reading
04 · Category
Malware And Tools21 stats
01
Lazarus deploys WannaCry ransomware using ETERNALBLUE exploit (CVE-2017-0144).
02
Group uses custom malware families like DESTOVER wiper in DarkSeoul.
03
SWIFT-compromising malware used in Bangladesh heist called evtdiag.exe.
04
Operation Blockbuster revealed 11 Lazarus malware families including SHIPSHAPE RAT.
05
AppleJeus macOS malware masquerades as crypto trading apps.
06
FASTCash malware targets ATM SWIFT POS systems for cashouts.
07
TraderTraitor uses Android malware like DeFiWalletFake for keylogging.
08
WannaCry exploits SMBv1 vulnerability with DOUBLEPULSAR backdoor.
09
Group employs spear-phishing with malicious Office docs exploiting CVE-2017-0199.
10
Custom RATs like LIGHTLESSSKY used in crypto exchange intrusions.
11
Operation Dream Job uses LinkedIn lures with Google Drive-hosted malware.
12
Lazarus uses Manuscrypt backdoor in multiple campaigns.
13
Tools include Mimikatz for credential dumping post-exploitation.
14
Cobalt Strike beacons repurposed for C2 in recent ops.
15
BrowserGood extension malware steals crypto wallet data.
16
LazariKey ransomware deployed against non-crypto targets.
17
Group leverages Tor for C2 and laundering via mixers.
18
Custom loaders like Rc4Aes dropper used in Atomic Wallet.
19
PowerShell-based loaders for initial access in banking ops.
20
Wiper malware variants evolve from Shamoon influences.
21
Nestead agent for persistence in Linux environments.
Interpretation
Malware And Tools Interpretation
Across these “Malware And Tools” cases, Lazarus is credited with 11 distinct malware families in Operation Blockbuster, ranging from ETERNALBLUE delivered ransomware like WannaCry to specialized wipers, SWIFT related tools, macOS disguises, and even ATM cashout malware like FASTCash.
05 · Category
Victims And Targets20 stats
01
Lazarus Group primarily targets financial institutions, governments, and crypto platforms worldwide.
02
South Korea has been hit by over 20 Lazarus campaigns since 2011.
03
US entities, including Sony and crypto firms, comprise 15% of known Lazarus victims.
04
Bangladesh Central Bank was a key victim in SWIFT hacks affecting 5 banks total.
05
Vietnam Airlines and other Asian carriers targeted for payment data.
06
Ronin Network, supporting Axie Infinity game with 2.5 million users, was breached.
07
Harmony blockchain's Horizon Bridge served DeFi users across 10+ chains.
08
Atomic Wallet had 2 million+ users affected by the malware campaign.
09
CoinsPaid, servicing 500k+ users, lost funds from hot wallets.
10
35+ cryptocurrency exchanges targeted by Lazarus since 2016.
11
South Korean government and military networks attacked in DarkSeoul.
12
Democratic National Committee servers probed by Lazarus actors.
13
Polish financial regulator and banks targeted in 2017.
14
Indian banks like Cosmos received malware implants.
15
NHS England hospitals disrupted, affecting 80 trusts.
16
Global manufacturing like FedEx and Telefónica hit by WannaCry.
17
Crypto platforms like ByBit and Stake.com investigated as Lazarus targets.
18
Over 10 Middle Eastern banks probed in FASTCash operations.
19
Gaming firms like Sky Mavis (Axie) represent emerging DeFi targets.
20
Youbit and Bithumb represent 2 of 5 major South Korean exchange victims.
Interpretation
Victims And Targets Interpretation
Across the Victims And Targets landscape, Lazarus repeatedly focuses on high-value entities worldwide, with South Korea seeing over 20 campaigns since 2011 and US organizations making up 15% of known victims, while major financial and crypto targets such as the Bangladesh Central Bank SWIFT-linked incident involving 5 banks and the Ronin Network breach affecting an Axie Infinity ecosystem of 2.5 million users show the campaign’s consistent reach and impact.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Aisha Okonkwo. (2026, February 24). Lazarus Group Statistics. Gitnux. https://gitnux.org/lazarus-group-statistics
MLA
Aisha Okonkwo. "Lazarus Group Statistics." Gitnux, 24 Feb 2026, https://gitnux.org/lazarus-group-statistics.
Chicago
Aisha Okonkwo. 2026. "Lazarus Group Statistics." Gitnux. https://gitnux.org/lazarus-group-statistics.
Sources & references
61 datasets cited across this report · attribution is report-level