4 July 2009: the DDoS that revealed the Lazarus Group to the world

It was 4 July 2009. In the United States, a national holiday: the streets of Washington were packed for the Independence Day fireworks. Meanwhile, the servers of the White House, the Pentagon, the New York Stock Exchange and more than twenty US government websites began to choke under an abnormal volume of requests. Within hours, several were offline for up to four hours. On the other side of the Pacific, South Korea suffered the same fate: the Blue House, the Ministry of Defense, the National Intelligence Service — all knocked over.

Nobody knew it yet, but that would be the baptism by fire of the Lazarus Group — the North Korean APT that in the years to come would rob Bangladesh's central bank, destroy Sony Pictures' servers and accumulate more than US$3 billion in stolen cryptocurrency, according to United Nations estimates.

The targets and the scale of the attack

Researchers identified at least 39 URLs on the target list found on the compromised systems. In Wave 1 (4 July), the United States was the main focus:

• White House (whitehouse.gov)
• Pentagon
• Treasury Department
• Secret Service (secretservice.gov)
• Federal Trade Commission (FTC)
• New York Stock Exchange and NASDAQ
• Washington Post and Amazon

In Wave 2 (7 July), the attackers turned to Seoul: the Blue House, the National Assembly, the Ministry of Defense and the National Intelligence Service itself. Wave 3 (9 July) again included American targets — among them the State Department.

The size of the botnet is disputed to this day. Symantec estimated around 50,000 compromised machines; South Korea's NIS put the figure at 20,000; a Vietnamese researcher who analysed the command-and-control server logs arrived at 166,000. What is fact: more than 400 C2 servers spread across 61 countries were used as relay infrastructure.

The malware: recycled code with a destructive payload

The two components identified were W32.Dozer (the dropper) and Trojan.Dozer (the DDoS payload). Analysis of the code revealed direct reuse of the MyDoom worm — malware that had been well documented since 2004.

What set Dozer apart from an ordinary DDoS was a secondary destruction payload: after running the attack, the malware wiped the hard drive's data and wrote the string Memory of the Independence Day to the infected machine's Master Boot Record — making a normal reboot impossible.

Researchers classified the code as "not sophisticated", with no evasion techniques or advanced obfuscation. The sophistication was in the scale and the coordination, not in the code itself.

Geopolitical context: the date was no accident

On the same day Wave 1 began, North Korea launched a series of short-range ballistic missiles into the Sea of Japan — the first military provocation since the UN Security Council approved Resolution 1874, sanctioning the regime after a nuclear test in May 2009.

Attacking US government websites on the supreme symbol of American national pride carried clear symbolic value, regardless of who was responsible.

Who was behind the DDoS attack of 4 July 2009?

Attribution to North Korea wasn't immediate, and only firmed up years later. In October 2009, the South Korean NIS formally pointed at Pyongyang. A year later, American officials "practically ruled out" that hypothesis, suggesting the attackers might be South Korean activists. The turning point came between 2013 and 2014: researchers connected the Trojan.Dozer code to the malware used in the DarkSeoul attack (March 2013), which took down three South Korean broadcasters and two banks with a wiper. That trail of code reuse was traced back to the group we now call the Lazarus Group, linked to the Reconnaissance General Bureau — North Korea's military intelligence agency. CISA formalised the connection in 2017 through the HIDDEN COBRA alert.

What the Lazarus Group is

It's an APT attributed to the North Korean government, tracked under several names by different firms: HIDDEN COBRA (CISA/NSA), Guardians of Peace, APT38. It operates under Bureau 121, the cyber warfare unit of North Korea's Reconnaissance General Bureau.

After 2009, Lazarus escalated in both sophistication and reach:

• 2014: the attack on Sony Pictures — data destruction and a leak of internal emails in retaliation for the film The Interview
• 2016: an attempt to steal US$1 billion from Bangladesh's central bank via SWIFT; US$81 million was transferred before detection
• 2017: the WannaCry ransomware, affecting more than 150 countries and disrupting hospitals in the UK's NHS
• 2018–today: systematic thefts from cryptocurrency exchanges — the UN estimates more than US$3 billion accumulated through 2023

The pattern attackers love: holidays as cover

Choosing 4 July wasn't only symbolic, it was tactical. With reduced security teams and slower response times on public holidays, the window of action widens.

The pattern repeated on 2 July 2021, when the REvil group exploited a zero-day in Kaseya VSA right before the long Independence Day weekend, compromising between 800 and 1,500 companies through managed service providers. The ransom demanded: US$70 million in bitcoin for a universal decryptor.

The deliberate choice of holidays as an attack window is now a documented APT practice — and one of the main arguments for security teams keeping on-call cover during holidays.

What 2009 taught — and what we still ignore

The attack was classified as "not sophisticated". And it took US government websites offline for hours, using code recycled from 2004 and a botnet of tens of thousands of machines. The clearest lesson of 2009 is that technical sophistication and real impact have no direct correlation: what determines the damage is scale, timing and clarity of objective.

Lazarus went from an amateur DDoS on an American summer holiday to being one of the most prolific cyber-theft groups in history. And it all started with MyDoom code, 400 C2 servers scattered around the world and an MBR stamped with "Memory of the Independence Day".

To understand how destructive attacks of state origin evolved in the years that followed, NotPetya in 2017 is the next chapter — considered the costliest cyberattack ever recorded. The historical root of this lineage of network malware is the Morris Worm of 1988, the first documented internet worm. And to understand how state digital espionage became an instrument of foreign policy, the Snowden case in 2013 — which came right after DarkSeoul — completes the picture.