Operation-Blockbuster-Report.pdf

Novetta's Operation Blockbuster report profiles the Lazarus Group as a long-running threat actor responsible for a diverse toolset (45+ malware families) used for espionage, DDoS, and destructive wiper attacks—most notably the November 2014 Sony Pictures Entertainment incident—providing detailed analysis of shared code, encryption schemes, dynamic API loading, fake-TLS communications, C2 infrastructure, targeting (primarily South Korea and the U.S.), and recommended mitigations.