LAZARUS GROUP · FAQ

LAZARUS GROUP appears on the OFAC SDN sanctions list under programmes DPRK3, CYBER2. North Korean state-sponsored cyber threat actor

The designation was made by US Treasury Office of Foreign Assets Control (OFAC). This is the authoritative source. Always reconcile derived data with the primary source before taking compliance action.

Applicable programs: DPRK3, CYBER2. Each program has a distinct legal scope, authority base, and set of prohibited activities. Multiple-program designations often compound in their practical effect.

This page reflects the latest snapshot synced from the issuing authority. Sanctions lists change frequently — for real-time screening use the source feed directly.

Yes. Each source list has a delisting petition process. For OFAC, see the Office of Foreign Assets Control delisting procedures. For UN 1267, the Ombudsperson mechanism applies. For EU, the EU General Court. Delistings are published in the same feeds as new designations.

Secondary sanctions risk: parties majority-owned by a sanctioned entity are typically treated as sanctioned (OFAC 50% Rule). Screen the whole ownership chain, not just the named entity.

Generally prohibited for persons in the designating jurisdiction without an OFAC licence (US) or competent-authority authorisation (EU/UK). Specific licences are narrow and time-bound.

AKAs: HIDDEN COBRA, Guardians of Peace. Screening should match on all aliases because primary lists often vary in transliteration.

Related entries share programmes or jurisdictions. The Related view shows 12 most closely-linked designations. Cross-links view connects to country, vertical, and corridor entities across the AJG knowledge graph.

Consult the original source list at sanctionssearch.ofac.treas.gov. AJG is a reference index, not a primary source.