BEYOND LAZARUS: HOW NORTH KOREA ORGANIZES ITS CYBER OPERATIONS

Summary from the TLDR InfoSec newsletter

North Korea has been shown to run offensive cyber as a self-funding arm of the state, with theft revenue estimated at over a billion dollars annually feeding sanctioned weapons programs. Sekoia and Kudelski Security mapped the hierarchy behind that model, covering the GRIB (ex-RGB), the NIA (ex-MSS), renamed in June, and the decomposition of the Lazarus umbrella into APT38, Andariel, Famous Chollima, and the Sleet sub-clusters. The paper also traces the enabling layer of IT worker units, Chinese and Russian academic pipelines, and front companies such as Ryonbong and Chinyong, while cautioning that constant institutional reshuffling limits how long any DPRK org chart stays accurate.