North Korea Lazarus Group Tops Cyber Threats with Spear Phishing Attacks

North Korean state-backed hackers, the Lazarus Group, primarily employed spear phishing attacks to steal funds over the last year, with the group receiving the most mentions in post-hack analyses over the last 12 months, according to South Korean cybersecurity company AhnLab.

Spear phishing is one of the most popular methods of attack by bad actors like Lazarus, using fake emails, “disguised as lecture invitations or interview requests,” AhnLab analysts said in the Nov. 26, 2025, Cyber ​​Threat Trends & 2026 Security Outlook report.