Full Breakdown
Emerging Cybercrime Alliance: Russia's Gamaredon and North Korea's Lazarus
11/22/2025, 3:29:03 PM
Unprecedented Collaboration in Cybercrime
Recent research by cybersecurity firm Gen Digital has revealed that two prominent state-linked cybercrime groups, Russia's Gamaredon and North Korea's Lazarus, are sharing resources and tactics, marking a significant development in international cybercrime. This collaboration is described as "unprecedented" by Michal Salat, Director of Threat Intelligence at Gen Digital, who noted that such cooperation among nation-state hacking groups is rare. The findings suggest a new level of coordination between Moscow and Pyongyang, particularly in the realm of Advanced Persistent Threat (APT) attacks, which are sophisticated, long-term campaigns typically executed by nation-state actors.
Gamaredon, associated with Russia's Federal Security Service, has been actively targeting Ukrainian government networks since the onset of the invasion in 2022, primarily for intelligence gathering. In contrast, the Lazarus group is notorious for a wide range of cyber activities, including espionage and financially motivated crimes. Analysts discovered that Gamaredon utilized Telegram channels to manage servers controlling its malware, one of which was also linked to Lazarus. This overlap indicates that the two groups may be directly cooperating or at least studying each other's methodologies.
Implications of the Alliance
The collaboration between Gamaredon and Lazarus could have significant implications for global cybersecurity. The research indicates that Gamaredon may be adopting tactics from Lazarus, which is known for employing deceptive job offers to lure victims and for its involvement in cryptocurrency theft—a crucial revenue stream for North Korea, especially under stringent international sanctions. This partnership could enhance the operational capabilities of both groups, potentially leading to more sophisticated cyberattacks.
Context of Increased Cooperation
The findings come against a backdrop of growing military and strategic cooperation between Russia and North Korea. Reports suggest that North Korea has dispatched thousands of soldiers to Russia to assist in the ongoing conflict in Ukraine. Additionally, Ukrainian military intelligence has indicated that North Korean troops have been involved in drone operations across the border, and there are plans for North Korea to send workers to Russia for drone manufacturing.
Criticism & Opposition
While the collaboration between these cybercrime groups raises alarms, it also invites scrutiny regarding the effectiveness of international cybersecurity measures. Critics argue that the increasing sophistication of state-sponsored cybercrime necessitates a reevaluation of current defense strategies and international cooperation among nations to counter such threats.
Official Statements & Responses
In light of these developments, cybersecurity experts emphasize the need for enhanced intelligence sharing and collaboration among nations to combat the evolving landscape of cyber threats. The situation underscores the importance of vigilance and proactive measures in addressing the challenges posed by state-linked cybercrime.
Verbatim Quotes
- “I don’t recall two countries working together on [Advanced Persistent Threat] attacks,” — Michal Salat, Director of Threat Intelligence, Gen Digital
- “Findings suggest a new level of coordination between Moscow and Pyongyang.” — Michal Salat, Director of Threat Intelligence, Gen Digital
This emerging alliance between Gamaredon and Lazarus highlights the evolving nature of cyber threats and the necessity for global cooperation in cybersecurity efforts.
