In February 2016, Novetta announced a profiling report entitled "Operation Blockbuster: Unraveling the Long Thread of Sony Attack" in association with global security companies (Kaspersky Lab, Symantec, Trend Micro, JPCERT / CC, etc.). The Lazarus group, which has been identified as the backbone of the report, has been active in the past, and Novetta 's research is helping to preemptively counteract and prevent Lazarus attacks around the world. However, global security companies are limited in collecting attack information in Korea, and there is also a lack of information about the attacks that Lazarus or Lazarus are suspected of as a small group of threat groups in Korea. Therefore, the Korea Financial Security Institute (FSI) identified the specific characteristics of domestic IT and work environment, and profiled specific threat groups that are using the attacks. The results are described in this report.