The most common attack method used by the North Korean hacking group Lazarus in the past year has been targeted phishing

According to AhnLab's "2025 Cyber Threat Trends and Security Outlook 2026" report, North Korean-backed hacking group Lazarus has been named the most in the past 12 months. It mainly uses "spear phishing" to carry out attacks, often disguised as lecture invitations, interview requests and other emails to induce targets to open. The report said that Lazarus is believed to be the main suspect in several major attacks, including the Bybit hack on February 21 this year (loss of $1.40 billion) and the recent $30 million vulnerability attack on the South Korean exchange Upbit.
AhnLab said that in order to improve security, enterprises need to establish a multi-layer protection system, including regular security audits, timely updates of patches and enhanced employee education. The company also advised individual users to use multi-factor authentication, handle unknown links and attachments carefully, avoid excessive exposure of personal information, and only download content from official channels. AhnLab pointed out that as the popularity of AI applications makes it easier for attackers to generate indistinguishable phishing emails, disguised pages and fake deepcontent, and related threats may be further complicated in the future. (Cointelegraph)