North Korean IT workers

Sekoia and Kudelski split the Lazarus umbrella into six DPRK sub-clusters

The joint research argues that constant reorganization under the GRIB and NIA is a control mechanism rather than administrative noise, and that treating Lazarus as one actor hides the revenue mandate driving most of the intrusions.