He Is Everywhere: A Tale Of Lazarus And His Family

The talk tackles a practical problem in threat intelligence: the same North Korean activity is reported under many different names by different vendors. Drawing on a personal collection of public reports, the speaker shows how the number of Lazarus-related write-ups has grown since 2018, and how vendors differ in whether they publish malware analysis or incident investigations, depending on how they obtain samples.

The speaker then groups roughly 140 code names into six clusters, including Lazarus, Kimsuky, Andariel and Konni, and compares the naming conventions used by different companies, from numeric labels to animal, gemstone and colour prefixes. The incident review sorts activity by motivation, such as destruction, espionage, data theft and financial gain, and notes that supply chain compromise, watering hole attacks and abuse of management software recur as initial access and lateral movement methods. South Korea, the United States, Japan and India appear as the most frequently affected countries.

The closing takeaway is that code names are confusing but useful for tracking overlapping activity, and that the group's focus appears to be shifting toward financial gain. Financial and cryptocurrency organisations are advised to assume they may already be targeted, and to check mail systems and web infrastructure, since compromised sites are often used in operations.