Malware · critical

How to fix Lazarus Group / Bluenoroff APT threat

Error code: LAZARUS_BLUENOROFF_APT

What this error means

Lazarus and its sub-group Bluenoroff are state-sponsored advanced persistent threat (APT) actors. They target global financial institutions, SWIFT networks, cryptocurrency exchanges, and blockchain platforms using sophisticated custom malware, trojanized applications, and spear-phishing. It's also often linked to exploitation of public-facing server vulnerabilities.

Updated

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 4 complete
01Perform network-wide host and memory forensics to locate custom implants
  1. Perform network-wide host and memory forensics to locate custom implants
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Enforce application control and code signing integrity policies
  1. Enforce application control and code signing integrity policies
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Revoke compromised administrative access and certificates
  1. Revoke compromised administrative access and certificates
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
04Implement strict network segmentation for critical environments
  1. Implement strict network segmentation for critical environments
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • Spear-phishing emails targeting high-value corporate employees
  • Downloading trojanized open-source utilities or crypto wallet apps
  • Exploitation of public-facing server vulnerabilities