Historically, threat researchers have tracked North Korea's threat activities as being carried out by individual groups — Lazarus Group and Kimsuky among them. A More Organized State-Sponsored StructureCOVID-19 marked a significant change in how North Korean threat groups operate, with an unprecedented level of coordination and information-sharing directly driven by the closure of borders during that time. "While it remains uncertain whether this collaboration was intentional or driven by necessity, there is no sign of a decrease in such activities," Barnhart says. Mandiant researchers compiled a comprehensive structure of the current North Korean APT landscape to help defenders understand what they're currently up against. In general, all threat groups lead back to Kim Jong Un, and all activity is either to provide funding or intelligence for the regime — or both.
