STAGE 5: ADVERSARY ATTRIBUTION ENGINEDIAMOND MODEL OF INTRUSIONTLSH CODE CLUSTERING

Diamond Model Threat Actor & Nation-State APT Attribution Studio

Correlate binary compiler artifacts (PDB, Rich Header), language code pages, SSL/JA3 fingerprints, and TLSH similarity to uncover nation-state threat vectors.

Match: Lazarus

Interactive Diamond Model Canvas (Sergio Caltagirone Framework)

4-Vertex Intrusion Graph

Selected Diamond Vertex: ADVERSARYActive Vector

RGB 121 Special Ops Bureau (Sub-units Andariel & Bluenoroff)

Nation-State Attribution Vector Radar

86.7% CONFIDENCE

OPERATIONAL TEMPO:

UTC+8:30 / UTC+9 (Pyongyang Standard Time - 08:00 to 18:00)

Multi-Factor Attribution Scoring Matrix & Artifact Evidence Chain

Dynamic weighted evaluation across 4 forensic pillars to calculate forensic attribution certainty against Lazarus Group (APT38 / HIDDEN COBRA).

WEIGHTS:

PDB: 25%Locale: 20%SSL/JA3: 25%TLSH: 30%

1. Compiler & PDB Artifacts98% Match

PDB Path:
D:\Dev\Lazarus_Project\WannaCry\Release\tasksche.pdb
Rich Header:0x5A8E192B41C90812 (VS2010 v10.0.30319)
Compiler:Microsoft Visual C/C++ 10.0 (Linker 10.00.40219)

2. Locale & Code Page95% Match

Code Page Fingerprint:
0x0412 (Korean - Hangul)
Primary Language:Korean (ko-KR) / US English Fallback
State Sponsor:Reconnaissance General Bureau (RGB)

3. SSL / JA3 Fingerprint96% Match

JA3 Hash:
a0e9f5d64349fb13191bc781f81f42e1
Cert Serial:7d:89:12:ef:aa:22:90:11:43:08
C2 Ports:TCP 445 (SMB), TCP 443 (HTTPS), TCP 9001 (Tor)

4. TLSH Code Reuse SimilarityScore: 64%

TLSH Distance:18 (Threshold < 40)
Locality Sensitive Hashing confirms subroutine overlap with known Lazarus Group (APT38 / HIDDEN COBRA) binaries.
WannaCryBrambulJoanap

Global APT Dossiers

6 Groups

🇰🇵 Lazarus98%

Reconnaissance General Bureau (RGB)

🇷🇺 Sandworm96%

Russian General Staff Main Intelligence Directorate (GRU)

🇷🇺 Cozy97%

Russian Foreign Intelligence Service (SVR)

🏴‍☠️ FIN794%

Transnational Cybercrime Syndicate (Eastern Europe)

🇨🇳 Volt95%

People's Republic of China (PRC - PLA SSF)

🏴‍☠️ LockBit99%

Transnational Cybercrime (Ransomware-as-a-Service)

🇰🇵

Lazarus Group (APT38 / HIDDEN COBRA)

ACTIVE

Sponsor: Reconnaissance General Bureau (RGB) (North Korea)

ZincDiamond SleetStardust ChollimaBureau 121 / Lab 110

Strategic Motive: Nation-State Revenue Generation, Sanctions Evasion & Cyber-Espionage

Targeted Industry Sectors:

Financial InstitutionsCryptocurrency ExchangesDefense ContractorsCritical Infrastructure

Signature Malware Arsenal:

WannaCryBrambulJoanapFallchillManuscryptAppleJeusFASTCash

Documented Global Cyber Campaigns

WannaCry 2.0 Global Outbreak(2017)

$4 Billion global disruption across NHS and 150 countries

CVE-2017-0144 (EternalBlue)

Sony Pictures Destructive Hack(2014)

Wiper detonation, corporate extortion, and leak of unreleased media

Brambul SMB Worm

Bangladesh Bank SWIFT Heist(2016)

$81 Million stolen via fraudulent SWIFT financial messaging

Custom SWIFT Alliance Injector

Ronin / Axie Infinity Crypto Drain(2022)

$620 Million cryptocurrency stolen via compromised validator nodes

AppleJeus macOS Backdoor