Lazarus Group (North Korea)

The Lazarus Group refers to a set of computer units tied to the Reconnaissance General Bureau, North Korea's main intelligence service. It stands apart from other state attackers by its purpose: it steals to fund a sanctioned state. It is credited with the 2014 Sony Pictures hack, the theft of 81 million dollars from Bangladesh's central bank through the SWIFT network in 2016, the WannaCry ransomware in 2017, then a series of ever larger crypto-asset thefts, up to the theft of about 1.5 billion dollars from an exchange in February 2025, attributed by the FBI. The US Treasury sanctioned Lazarus and two of its subgroups in September 2019. For insurance, the consequences are direct. A victim who paid a ransom to a Lazarus-linked entity would breach US sanctions, under a strict civil liability regime, and so would the insurer reimbursing it. Crypto-asset platforms, banks and their crime insurers are exposed to exceptionally large losses, and the theft of private keys or the compromise of a provider is enough. Finally, the group places North Korean IT workers recruited remotely under false identities, which turns a hire into a sanctions breach.