The Lazarus Group operates through multiple subgroups that vary significantly in technical skill and execution quality.

Claim

Quotes that support claims

It appears that the group has divided into multiple subgroups that are not necessarily of the same technical sophistication. This can be observed through the many documented examples of bad practices coming from these ‘frontline’ groups that execute social engineering attacks when compared to the more sophisticated post-exploitation techniques applied in some of these known hacks.
It appears that the group has divided into multiple subgroups that are not necessarily of the same technical sophistication.