Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.[1][2] The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. [3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups, such as Andariel, APT37, APT38, and Kimsuky.

ID: G0032
Associated Groups: Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY
Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet; Dragos Threat Intelligence
Version: 3.2
Created: 31 May 2017
Last Modified: 30 March 2023

Associated Group Descriptions

Name Description
Labyrinth Chollima

[4]

HIDDEN COBRA

The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.[1][5]

Guardians of Peace

[1]

ZINC

[6]

NICKEL ACADEMY

[7]

Campaigns

ID Name First Seen Last Seen References Techniques
C0022 Operation Dream Job September 2019 [8] August 2020 [9]

[9][10][11][8]

Account Discovery: Domain Account, Acquire Infrastructure: Server, Acquire Infrastructure: Domains, Acquire Infrastructure: Web Services, Application Layer Protocol: Web Protocols, Archive Collected Data: Archive via Utility, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Brute Force, Command and Scripting Interpreter: Visual Basic, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Windows Command Shell, Compromise Infrastructure: Domains, Compromise Infrastructure: Server, Data from Local System, Debugger Evasion, Develop Capabilities: Code Signing Certificates, Develop Capabilities: Malware, Encrypted Channel: Symmetric Cryptography, Establish Accounts: Social Media Accounts, Establish Accounts: Email Accounts, Exfiltration Over C2 Channel, Exfiltration Over Web Service: Exfiltration to Cloud Storage, File and Directory Discovery, Gather Victim Identity Information, Gather Victim Org Information, Gather Victim Org Information: Identify Roles, Impersonation, Indicator Removal: File Deletion, Ingress Tool Transfer, Internal Spearphishing, Masquerading: Masquerade File Type, Native API, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information, Obtain Capabilities: Code Signing Certificates, Obtain Capabilities: Tool, Phishing: Spearphishing via Service, Phishing: Spearphishing Attachment, Phishing: Spearphishing Link, Scheduled Task/Job: Scheduled Task, Search Open Websites/Domains: Social Media, Server Software Component: IIS Components, Stage Capabilities: Upload Malware, Stage Capabilities: Upload Tool, Subvert Trust Controls: Code Signing, System Binary Proxy Execution: Rundll32, System Binary Proxy Execution: Regsvr32, System Location Discovery: System Language Discovery, Template Injection, User Execution: Malicious Link, User Execution: Malicious File, Virtualization/Sandbox Evasion: System Checks, Virtualization/Sandbox Evasion: Time Based Evasion, Windows Management Instrumentation, XSL Script Processing

Techniques Used

Domain ID Name Use
Enterprise T1134 .002 Access Token Manipulation: Create Process with Token

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.[3][12]

Enterprise T1087 .002 Account Discovery: Domain Account

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.[8]

Enterprise T1098 Account Manipulation

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.[3][13]

Enterprise T1583 .001 Acquire Infrastructure: Domains

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.[14][15]

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.[8]

.004 Acquire Infrastructure: Server

During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.[8]

.006 Acquire Infrastructure: Web Services

Lazarus Group has hosted malicious downloads on Github.[14]

During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.[9]

Enterprise T1557 .001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.[16]

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Lazarus Group has conducted C2 over HTTP and HTTPS.[17][18][19][20][21][22]

During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.[10]

Enterprise T1010 Application Window Discovery

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.[3][23][12]

Enterprise T1560 Archive Collected Data

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2. [23][24][17]

.001 Archive via Utility

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.[8]

.002 Archive via Library

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.[24][17]

.003 Archive via Custom Method

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.[3][23][24][17]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.[3][24][17][20]

During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.[10]

.009 Boot or Logon Autostart Execution: Shortcut Modification

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.[17]

Enterprise T1110 .003 Brute Force: Password Spraying

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.[3][24]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Lazarus Group has used PowerShell to execute commands and malicious code.[15]

During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.[8]

.003 Command and Scripting Interpreter: Windows Command Shell

Lazarus Group malware uses cmd.exe to execute commands on a compromised host.[3][13][17][25][21] A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.[26]

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.[8][10]

.005 Command and Scripting Interpreter: Visual Basic

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.[20][21]

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.[9][10]

Enterprise T1584 .001 Compromise Infrastructure: Domains

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.[10][11]

.004 Compromise Infrastructure: Server

Lazarus Group has compromised servers to stage malicious tools.[16]

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.[9][8][10]

Enterprise T1543 .003 Create or Modify System Process: Windows Service

Several Lazarus Group malware families install themselves as new services.[3][13]

Enterprise T1485 Data Destruction

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.[3]

Enterprise T1132 .001 Data Encoding: Standard Encoding

A Lazarus Group malware sample encodes data with base64.[17]

Enterprise T1005 Data from Local System

Lazarus Group has collected data and files from compromised networks.[3][23][24][16]

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.[9][10]

Enterprise T1001 .003 Data Obfuscation: Protocol Impersonation

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.[3][13][17][26]

Enterprise T1074 .001 Data Staged: Local Data Staging

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.[3][23]

Enterprise T1622 Debugger Evasion

During Operation Dream Job, Lazarus Group used tools that used the IsDebuggerPresent call to detect debuggers.[9]

Enterprise T1491 .001 Defacement: Internal Defacement

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.[13]

Enterprise T1140 Deobfuscate/Decode Files or Information

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.[20][21]

Enterprise T1587 .001 Develop Capabilities: Malware

Lazarus Group has developed custom malware for use in their operations.[14][15]

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.[9][8][10][11]

.002 Develop Capabilities: Code Signing Certificates

During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.[8]

Enterprise T1561 .001 Disk Wipe: Disk Content Wipe

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.[13]

.002 Disk Wipe: Disk Structure Wipe

Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.[25][3]

Enterprise T1189 Drive-by Compromise

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.[27][15]

Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.[3][13][17][26]

During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.[10]

Enterprise T1585 .001 Establish Accounts: Social Media Accounts

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.[15]

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.[9][8]

.002 Establish Accounts: Email Accounts

Lazarus Group has created new email accounts for spearphishing operations.[16]

During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.[8]

Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.[3][24]

Enterprise T1041 Exfiltration Over C2 Channel

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.[3][23][17]

During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.[9]

Enterprise T1567 .002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.[8][9]

Enterprise T1203 Exploitation for Client Execution

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.[28]

Enterprise T1008 Fallback Channels

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.[3][24]

Enterprise T1083 File and Directory Discovery

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.[3][26][20][21]

During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.[9]

Enterprise T1589 .002 Gather Victim Identity Information: Email Addresses

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.[16]

Enterprise T1591 Gather Victim Org Information

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.[16]

For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.[9]

.004 Identify Roles

During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.[9][8]

Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.[17][18][19][20]

Enterprise T1574 .002 Hijack Execution Flow: DLL Side-Loading

Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.[22]

.013 Hijack Execution Flow: KernelCallbackTable

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.[20][21]

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.[3][23][12][25].

.004 Impair Defenses: Disable or Modify System Firewall

Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. [3][23][12]

Enterprise T1656 Impersonation

During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.[9][8][29]

Enterprise T1070 Indicator Removal

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.[20]

.003 Clear Command History

Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.[16]

.004 File Deletion

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.[3][26]

During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.[8]

.006 Timestomp

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.[3][13][23][26]

Enterprise T1202 Indirect Command Execution

Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.[21]

Enterprise T1105 Ingress Tool Transfer

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.[3][13][23][18][19][16][15][20][21][22]

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.[9][8][10]

Enterprise T1056 .001 Input Capture: Keylogging

Lazarus Group malware KiloAlfa contains keylogging functionality.[3][12]

Enterprise T1534 Internal Spearphishing

During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.[9]

Enterprise T1036 .003 Masquerading: Rename System Utilities

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.[21]

.004 Masquerading: Masquerade Task or Service

Lazarus Group has used a scheduled task named SRCheck to mask the execution of a malicious .dll.[22]

.005 Masquerading: Match Legitimate Name or Location

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.[30][21]

.008 Masquerading: Masquerade File Type

During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.[10][8]

Enterprise T1104 Multi-Stage Channels

Lazarus Group has used multi-stage malware components that inject later stages into separate processes.[20]

Enterprise T1106 Native API

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server.[10] Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.[20][21]

During Operation Dream Job, Lazarus Group used Windows API ObtainUserAgentString to obtain the victim's User-Agent and used the value to connect to their C2 server.[10]

Enterprise T1046 Network Service Discovery

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.[16]

Enterprise T1571 Non-Standard Port

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.[3][24]

Enterprise T1027 Obfuscated Files or Information

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.[3][23][24][17][19][20][21]

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.[9][8][10][11]

.002 Software Packing

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.[9][10][11]

.007 Dynamic API Resolution

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.[20]

Enterprise T1588 .002 Obtain Capabilities: Tool

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.[16]

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.[9][8]

.003 Obtain Capabilities: Code Signing Certificates

During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.[8]

.004 Obtain Capabilities: Digital Certificates

Lazarus Group has obtained SSL certificates for their C2 domains.[14]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.[28][16][20][21]

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.[9][10]

.002 Phishing: Spearphishing Link

Lazarus Group has sent malicious links to victims via email.[16]

During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.[9][8]

.003 Phishing: Spearphishing via Service

Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.[15]

During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.[9][8]

Enterprise T1542 .003 Pre-OS Boot: Bootkit

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.[3][13]

Enterprise T1057 Process Discovery

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[3][23][17][26][19][20]

Enterprise T1055 .001 Process Injection: Dynamic-link Library Injection

A Lazarus Group malware sample performs reflective DLL injection.[17][20]

Enterprise T1090 .001 Proxy: Internal Proxy

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.[16]

.002 Proxy: External Proxy

Lazarus Group has used multiple proxies to obfuscate network traffic from victims.[31][19]

Enterprise T1012 Query Registry

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.[3][23][17]

Enterprise T1620 Reflective Code Loading

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.[20][21]

Enterprise T1021 .001 Remote Services: Remote Desktop Protocol

Lazarus Group malware SierraCharlie uses RDP for propagation.[3][24]

.002 Remote Services: SMB/Windows Admin Shares

Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.[3][24]

.004 Remote Services: SSH

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.[16]

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.[21][22]

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.[8]

Enterprise T1593 .001 Search Open Websites/Domains: Social Media

For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.[8]

Enterprise T1505 .004 Server Software Component: IIS Components

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.[10]

Enterprise T1489 Service Stop

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.[13]

Enterprise T1608 .001 Stage Capabilities: Upload Malware

For Operation Dream Job, Lazarus Group used compromised servers to host malware.[9][8][10][11]

.002 Stage Capabilities: Upload Tool

For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.[8]

Enterprise T1553 .002 Subvert Trust Controls: Code Signing

Lazarus Group has digitally signed malware and utilities to evade detection.[20]

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.[8]

Enterprise T1218 System Binary Proxy Execution

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.[20][21]

.005 Mshta

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.[20][21]

.010 Regsvr32

During Operation Dream Job, Lazarus Group used regsvr32 to execute malware.[8]

.011 Rundll32

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.[22]

During Operation Dream Job, Lazarus Group executed malware with C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db", CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905.[9][8][10]

Enterprise T1082 System Information Discovery

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.[3][13][23][17][26][20]

Enterprise T1614 .001 System Location Discovery: System Language Discovery

During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.[9]

Enterprise T1016 System Network Configuration Discovery

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.[3][23]

Enterprise T1049 System Network Connections Discovery

Lazarus Group has used net use to identify and establish a network connection with a remote host.[16]

Enterprise T1033 System Owner/User Discovery

Various Lazarus Group malware enumerates logged-on users.[3][13][23][24][17][18][20]

Enterprise T1529 System Shutdown/Reboot

Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.[25]

Enterprise T1124 System Time Discovery

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.[26]

Enterprise T1221 Template Injection

During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.[9][10]

Enterprise T1204 .001 User Execution: Malicious Link

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.[9][8]

.002 User Execution: Malicious File

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.[28][16][20][21]

During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.[9][10]

Enterprise T1078 Valid Accounts

Lazarus Group has used administrator credentials to gain access to restricted network segments.[16]

Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.[9]

.003 Virtualization/Sandbox Evasion: Time Based Evasion

During Operation Dream Job, Lazarus Group used tools that collected GetTickCount and GetSystemTimeAsFileTime data to detect sandbox or VMware services.[9]

Enterprise T1102 .002 Web Service: Bidirectional Communication

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.[20]

Enterprise T1047 Windows Management Instrumentation

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.[3][24][16][21]

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.[8]

Enterprise T1220 XSL Script Processing

During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.[8]

ICS T0865 Spearphishing Attachment

Lazarus Group has been observed targeting organizations using spearphishing documents with embedded malicious payloads. [32] Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company. [33]

Software

ID Name References Techniques
S0584 AppleJeus [14] Abuse Elevation Control Mechanism: Bypass User Account Control, Application Layer Protocol: Web Protocols, Command and Scripting Interpreter: Unix Shell, Create or Modify System Process: Windows Service, Create or Modify System Process: Launch Daemon, Deobfuscate/Decode Files or Information, Event Triggered Execution: Installer Packages, Exfiltration Over C2 Channel, Hide Artifacts: Hidden Files and Directories, Indicator Removal: File Deletion, Obfuscated Files or Information, Phishing: Spearphishing Link, Scheduled Task/Job: Scheduled Task, Subvert Trust Controls: Code Signing, System Binary Proxy Execution: Msiexec, System Information Discovery, System Services: Launchctl, User Execution: Malicious File, User Execution: Malicious Link, Virtualization/Sandbox Evasion: Time Based Evasion
S0347 AuditCred [34] Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Obfuscated Files or Information, Process Injection, Proxy
S0245 BADCALL [35] Data Obfuscation: Protocol Impersonation, Encrypted Channel: Symmetric Cryptography, Impair Defenses: Disable or Modify System Firewall, Modify Registry, Non-Standard Port, Proxy, System Information Discovery, System Network Configuration Discovery
S0239 Bankshot [28] Access Token Manipulation: Create Process with Token, Account Discovery: Local Account, Account Discovery: Domain Account, Application Layer Protocol: Web Protocols, Automated Collection, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data Encoding: Non-Standard Encoding, Data from Local System, Data Obfuscation: Protocol Impersonation, Deobfuscate/Decode Files or Information, Exfiltration Over C2 Channel, Exploitation for Client Execution, File and Directory Discovery, Indicator Removal: File Deletion, Indicator Removal: Timestomp, Indicator Removal, Ingress Tool Transfer, Modify Registry, Native API, Non-Standard Port, Process Discovery, Query Registry, System Information Discovery
S0520 BLINDINGCAN [36] Application Layer Protocol: Web Protocols, Command and Scripting Interpreter: Windows Command Shell, Data Encoding: Standard Encoding, Data from Local System, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal: File Deletion, Indicator Removal: Timestomp, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Obfuscated Files or Information, Obfuscated Files or Information: Software Packing, Phishing: Spearphishing Attachment, Shared Modules, Subvert Trust Controls: Code Signing, System Binary Proxy Execution: Rundll32, System Information Discovery, System Network Configuration Discovery, User Execution: Malicious File
S0498 Cryptoistic [18] Data from Local System, Encrypted Channel, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Non-Application Layer Protocol, System Owner/User Discovery
S0497 Dacls [18][19] Application Layer Protocol: Web Protocols, Create or Modify System Process: Launch Agent, Create or Modify System Process: Launch Daemon, File and Directory Discovery, Hide Artifacts: Hidden Files and Directories, Ingress Tool Transfer, Masquerading, Obfuscated Files or Information, Process Discovery
S0694 DRATzarus During Operation Dream Job, Lazarus Group used DRATzarus to deploy open source software and partly commodity software such as Responder, Wake-On-Lan, and ChromePass to target infected hosts.[9] Application Layer Protocol: Web Protocols, Data from Local System, Debugger Evasion, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Native API, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information, Process Discovery, Remote System Discovery, System Owner/User Discovery, System Time Discovery, Virtualization/Sandbox Evasion: Time Based Evasion
S0567 Dtrack [37] Archive Collected Data, Boot or Logon Autostart Execution, Browser Information Discovery, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data from Local System, Data Staged: Local Data Staging, Deobfuscate/Decode Files or Information, File and Directory Discovery, Hijack Execution Flow, Indicator Removal: File Deletion, Ingress Tool Transfer, Input Capture: Keylogging, Masquerading: Match Legitimate Name or Location, Obfuscated Files or Information: Embedded Payloads, Process Discovery, Process Injection: Process Hollowing, Query Registry, Shared Modules, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery, Valid Accounts
S0593 ECCENTRICBANDWAGON [38] Command and Scripting Interpreter: Windows Command Shell, Data Staged: Local Data Staging, Indicator Removal: File Deletion, Input Capture: Keylogging, Obfuscated Files or Information, Screen Capture
S0181 FALLCHILL [31] Create or Modify System Process: Windows Service, Data Obfuscation: Protocol Impersonation, Encrypted Channel: Symmetric Cryptography, File and Directory Discovery, Indicator Removal: Timestomp, Indicator Removal: File Deletion, System Information Discovery, System Network Configuration Discovery
S0246 HARDRAIN [39] Command and Scripting Interpreter: Windows Command Shell, Data Obfuscation: Protocol Impersonation, Impair Defenses: Disable or Modify System Firewall, Non-Standard Port, Proxy
S0376 HOPLIGHT [5] Command and Scripting Interpreter: Windows Command Shell, Data Encoding: Standard Encoding, Device Driver Discovery, Exfiltration Over C2 Channel, Fallback Channels, File and Directory Discovery, Impair Defenses: Disable or Modify System Firewall, Ingress Tool Transfer, Modify Registry, Non-Standard Port, OS Credential Dumping: Security Account Manager, Process Injection, Proxy, Query Registry, System Information Discovery, System Services: Service Execution, System Time Discovery, Use Alternate Authentication Material: Pass the Hash, Windows Management Instrumentation
S0431 HotCroissant [40] Application Window Discovery, Command and Scripting Interpreter: Windows Command Shell, Encrypted Channel: Symmetric Cryptography, Exfiltration Over C2 Channel, File and Directory Discovery, Hide Artifacts: Hidden Window, Indicator Removal: File Deletion, Ingress Tool Transfer, Native API, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information, Process Discovery, Scheduled Task/Job: Scheduled Task, Screen Capture, Service Stop, Software Discovery, System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery, System Service Discovery
S0271 KEYMARBLE [41] Command and Scripting Interpreter: Windows Command Shell, Encrypted Channel: Symmetric Cryptography, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Modify Registry, Process Discovery, Screen Capture, System Information Discovery, System Network Configuration Discovery
S0108 netsh [23] Event Triggered Execution: Netsh Helper DLL, Impair Defenses: Disable or Modify System Firewall, Proxy, Software Discovery: Security Software Discovery
S0238 Proxysvc [26] Application Layer Protocol: Web Protocols, Automated Collection, Command and Scripting Interpreter: Windows Command Shell, Data Destruction, Data from Local System, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal: File Deletion, Process Discovery, Query Registry, System Information Discovery, System Network Configuration Discovery, System Services: Service Execution, System Time Discovery
S0241 RATANKBA [42] Account Discovery: Local Account, Application Layer Protocol: Web Protocols, Command and Scripting Interpreter: Windows Command Shell, Command and Scripting Interpreter: PowerShell, Ingress Tool Transfer, Process Discovery, Process Injection: Dynamic-link Library Injection, Query Registry, Remote System Discovery, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery, System Owner/User Discovery, System Service Discovery, Windows Management Instrumentation
S0364 RawDisk [3][13] Data Destruction, Disk Wipe: Disk Structure Wipe, Disk Wipe: Disk Content Wipe
S0174 Responder [9] Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Network Sniffing
S0103 route [16] System Network Configuration Discovery
S0586 TAINTEDSCRIBE [30] Archive Collected Data, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Data Obfuscation: Protocol Impersonation, Encrypted Channel: Symmetric Cryptography, Fallback Channels, File and Directory Discovery, Indicator Removal: Timestomp, Indicator Removal: File Deletion, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Obfuscated Files or Information: Binary Padding, Process Discovery, Remote System Discovery, System Information Discovery, System Time Discovery
S0665 ThreatNeedle [16] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Create or Modify System Process: Windows Service, Data from Local System, Deobfuscate/Decode Files or Information, File and Directory Discovery, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Modify Registry, Obfuscated Files or Information, Obfuscated Files or Information: Fileless Storage, Phishing: Spearphishing Attachment, System Information Discovery, User Execution: Malicious File
S0678 Torisma During Operation Dream Job, Lazarus Group used Torisma to actively monitor for new drives and remote desktop connections on an infected system.[10][11] Application Layer Protocol: Web Protocols, Data Encoding: Standard Encoding, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Execution Guardrails, Exfiltration Over C2 Channel, Native API, Obfuscated Files or Information, Obfuscated Files or Information: Software Packing, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery, System Time Discovery
S0263 TYPEFRAME [43] Command and Scripting Interpreter: Visual Basic, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, File and Directory Discovery, Impair Defenses: Disable or Modify System Firewall, Indicator Removal: File Deletion, Ingress Tool Transfer, Modify Registry, Non-Standard Port, Obfuscated Files or Information: Fileless Storage, Obfuscated Files or Information, Proxy, System Information Discovery, User Execution: Malicious File
S0180 Volgmer [44] Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Encrypted Channel: Asymmetric Cryptography, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Masquerading: Masquerade Task or Service, Modify Registry, Native API, Obfuscated Files or Information: Fileless Storage, Obfuscated Files or Information, Process Discovery, Query Registry, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery, System Service Discovery
S0366 WannaCry [45][46][47][48] Create or Modify System Process: Windows Service, Data Encrypted for Impact, Encrypted Channel: Asymmetric Cryptography, Exploitation of Remote Services, Exploitation of Remote Services, File and Directory Discovery, File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Hide Artifacts: Hidden Files and Directories, Inhibit System Recovery, Lateral Tool Transfer, Lateral Tool Transfer, Peripheral Device Discovery, Proxy: Multi-hop Proxy, Remote Service Session Hijacking: RDP Hijacking, Remote System Discovery, Service Stop, System Network Configuration Discovery, Windows Management Instrumentation

References

  1. US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure. Retrieved July 13, 2017.
  2. US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.
  3. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  4. CrowdStrike. (2022, February 1). CrowdStrike Adversary Labyrinth Chollima. Retrieved February 1, 2022.
  5. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  6. Smith, B. (2017, December 19). Microsoft and Facebook disrupt ZINC malware attack to protect customers and the internet from ongoing cyberthreats. Retrieved December 20, 2017.
  7. Secureworks. (2017, December 15). Media Alert - Secureworks Discovers North Korean Cyber Threat Group, Lazarus, Spearphishing Financial Executives of Cryptocurrency Companies. Retrieved December 27, 2017.
  8. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.
  9. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  10. Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.
  11. Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.
  12. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Tools Report. Retrieved March 10, 2016.
  13. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
  14. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  15. Weidemann, A. (2021, January 25). New campaign targeting security researchers. Retrieved December 20, 2021.
  16. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.
  17. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  18. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  19. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.
  20. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
  21. Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.
  22. Cherepanov, Anton. (2019, November 10). ESETresearch discovered a trojanized IDA Pro installer. Retrieved March 2, 2022.
  23. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  24. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.
  1. US-CERT. (2018, March 09). Malware Analysis Report (MAR) - 10135536.11.WHITE. Retrieved June 13, 2018.
  2. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  3. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  4. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  5. Lakshmanan, R. (2022, August 17). North Korea Hackers Spotted Targeting Job Seekers with macOS Malware. Retrieved April 10, 2023.
  6. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  7. US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.
  8. Novetta Threat Research Group 2016, February 24 Operation Blockbuster: Unraveling the Long Thread of the Sony Attack Retrieved. 2016/02/25
  9. Eduard Kovacs 2018, March 1 Five Threat Groups Target Industrial Systems: Dragos Retrieved. 2020/01/03
  10. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.
  11. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.
  12. US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.
  13. Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021.
  14. Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021.
  15. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.
  16. US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020.
  17. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  18. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  19. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  20. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  21. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  22. Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved March 25, 2019.
  23. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
  24. Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.