Report reveals how this hacking group went from crypto attacks to targeting defence sector

Kaspersky has conducted an investigation into DeathNote, a cluster belonging to the notorious Lazarus group, which has undergone a significant transformation in recent years.

Beginning with cryptocurrency-related attacks in 2019, by the end of 2022, DeathNote was responsible for targeted campaigns against IT and defence companies in Europe, Latin America, South Korea, and Africa. The latest report from Kaspersky tracks the evolution of DeathNote’s targets and the development of its tools, techniques, and procedures over the past four years.

The report shows how Lazarus’ DeathNote cluster has moved beyond crypto attacks to focus on the defence sector with upgraded capabilities.