Lazarus_Group__2016__Operation-Blockbuster-Report.pdf

Operation Blockbuster is a Novetta-led technical report that profiles the Lazarus Group, a long-lived cyber threat actor responsible for a broad toolset of more than 45 malware families (RATs, loaders, installers, DDoS bots, and destructive wipers) and linked to high‑impact campaigns including the November 2014 Sony Pictures Entertainment breach; the report documents code reuse, shared cryptographic keys, dynamic API loading and fake-TLS techniques, C2 infrastructure characteristics, targeted file types and remediation recommendations, and provides YARA rules and hashes to help detection and disruption.