State-Sponsored and Silent: How North Korea's Lazarus Group Turned the Software Supply Chain Into a Trojan Horse for U.S. Defense

For most Americans, North Korea registers as a distant geopolitical concern — nuclear posturing, diplomatic stalemates, satellite launches that arc over the Pacific. What rarely makes the evening news is the quieter, more insidious campaign being waged inside the networks of U.S. defense contractors, software vendors, and technology firms. The architects of that campaign are known to the cybersecurity community by a single name: Lazarus Group.

Linked by multiple U.S. government agencies — including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of the Treasury — to North Korea's Reconnaissance General Bureau, Lazarus is not a loosely affiliated hacking collective. It is a disciplined, well-resourced arm of a nation-state with a specific mandate: generate revenue for the regime and steal intellectual property that advances its military ambitions.

What has shifted dramatically in recent years is how they do it.

From Sony Pictures to Silent Infiltration

Lazarus first captured widespread American attention in 2014 with the destructive breach of Sony Pictures Entertainment — an operation that wiped hard drives, leaked confidential emails, and embarrassed one of Hollywood's major studios. It was loud, theatrical, and almost certainly intentional in its visibility.

The group's subsequent evolution has been characterized by the opposite impulse: patience and concealment. After pivoting to large-scale cryptocurrency theft — the United Nations estimates Lazarus has stolen more than $3 billion in digital assets since 2017 — the group began layering a third objective onto its portfolio: long-duration espionage against American industrial and defense targets.

The vehicle for that espionage is the software supply chain.

What a Supply Chain Attack Actually Means

The term "supply chain attack" is frequently invoked but often poorly understood. In practical terms, it refers to a compromise that does not target an organization directly. Instead, attackers infiltrate a trusted third party — a software vendor, a build system, an open-source library, a managed service provider — and use that trusted relationship as a conduit to reach the ultimate target.

The 2020 SolarWinds breach, attributed to Russian intelligence, demonstrated just how catastrophic this vector can be: a single poisoned software update reached approximately 18,000 organizations, including multiple U.S. federal agencies. Lazarus has studied those lessons carefully.

Attribution research published by firms including Mandiant, CrowdStrike, and Recorded Future has documented Lazarus campaigns in which operatives compromised software build environments, injected malicious code into legitimate update packages, and waited — sometimes for months — before activating their payloads. In several documented cases, the initial intrusion was traced not to a phishing email targeting the defense contractor itself, but to a small software vendor whose product was deeply embedded in that contractor's operational environment.

The Anatomy of a Lazarus Supply Chain Operation

While Lazarus employs a range of techniques, researchers have identified several consistent patterns in its supply chain campaigns directed at U.S. defense and aerospace targets.

Initial Access via Trusted Vendors. Lazarus operatives frequently begin by targeting smaller technology companies — often with fewer than 200 employees — that hold privileged access to larger defense contractors through software licensing agreements, remote monitoring tools, or IT support relationships. These smaller firms are attractive precisely because their security posture is typically weaker.

Living Off the Land. Once inside a network, Lazarus operators are known to rely heavily on legitimate system tools — PowerShell, Windows Management Instrumentation, legitimate remote administration software — rather than custom malware. This approach, commonly called "living off the land," significantly reduces the likelihood of triggering endpoint detection systems that look for known malicious signatures.

Long Dwell Times. The group demonstrates a willingness to remain dormant inside compromised environments for extended periods, conducting reconnaissance and mapping network architecture before taking any action that might generate alerts. Dwell times exceeding six months have been documented in multiple incidents.

Credential Harvesting at Scale. A consistent objective across Lazarus intrusions is the acquisition of valid credentials — particularly those belonging to privileged accounts such as system administrators or software developers with access to code repositories and build pipelines.

The Geopolitical Stakes

Understanding why Lazarus pursues U.S. defense contractors requires understanding what Pyongyang actually wants from these operations. The answer, according to analysts at the RAND Corporation and the Center for Strategic and International Studies, is two-fold.

First, stolen defense intellectual property — schematics, materials specifications, propulsion data — can meaningfully accelerate North Korea's weapons development programs at a fraction of the cost of independent research. Second, access to contractor networks may provide intelligence about U.S. military capabilities, readiness postures, and procurement priorities that has direct strategic value.

This is not theoretical. In 2022, CISA and the National Security Agency issued a joint advisory explicitly warning that Lazarus-affiliated actors had targeted defense contractors working across multiple sectors including combat systems, submarine technology, and aerospace engineering. The advisory noted that in several cases, the actors had maintained persistent access for more than a year before detection.

What Organizations Should Be Doing Now

For organizations in the defense industrial base — and for any company that serves as a vendor to that base — the Lazarus threat demands a specific defensive posture. General cybersecurity hygiene, while necessary, is insufficient against a patient, state-sponsored adversary with this level of operational sophistication.

Audit Third-Party Access Ruthlessly. Every vendor, contractor, or managed service provider with privileged access to your environment represents a potential ingress point. Organizations should maintain a current inventory of all third-party access relationships, enforce least-privilege principles across those relationships, and require vendors to demonstrate their own security controls through audits or attestations.

Harden the Software Build Pipeline. Code signing, integrity verification for software updates, and strict controls over who can modify build configurations are foundational. The NIST Secure Software Development Framework provides a detailed roadmap for organizations seeking to systematically reduce supply chain risk.

Deploy Behavioral Detection, Not Just Signature-Based Tools. Because Lazarus operators frequently avoid deploying novel malware, traditional antivirus solutions offer limited protection. Endpoint detection and response platforms that analyze behavioral patterns — unusual PowerShell execution, lateral movement between systems, anomalous outbound data transfers — are far more likely to surface an ongoing intrusion.

Segment Networks and Limit Lateral Movement. A compromise of one system should not provide a pathway to every other system on the network. Network segmentation, enforced through both technical controls and rigorous access policies, limits the blast radius of any successful intrusion.

Treat Credential Security as a Priority. Multi-factor authentication on all privileged accounts, regular credential rotation, and continuous monitoring for credential reuse or anomalous authentication attempts are baseline requirements — not optional enhancements.

A Threat That Is Not Going Away

Lazarus Group operates within a strategic context that provides it with both resources and impunity. North Korea faces limited exposure to the diplomatic consequences that constrain other state actors, and the financial returns from its cyber operations — particularly cryptocurrency theft — have demonstrably funded the program's continued expansion.

For American companies in the defense supply chain, the uncomfortable reality is that they are not merely commercial enterprises managing ordinary business risk. They are, whether they chose to be or not, participants in an ongoing geopolitical conflict being waged across fiber-optic cables and software repositories. Recognizing that reality — and resourcing security programs accordingly — is no longer a matter of best practice. It is a matter of national consequence.