Lazarus Group

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.^[3][13]

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.^[9]

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.^[15][16]

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.^[9]

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.^[17]

Lazarus Group has conducted C2 over HTTP and HTTPS.^{[18][19][20][21][22][23]}

During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.^[11]

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.^{[3][25][18][21]}

During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.^[11]

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.^[3][25]

Lazarus Group has used PowerShell to execute commands and malicious code.^[16]

During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.^[9]

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.^[11][12]

Several Lazarus Group malware families install themselves as new services.^[3][14]

A Lazarus Group malware sample encodes data with base64.^[18]

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.^{[3][14][18][28]}

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.^[3][24]

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.^[14]

Lazarus Group has developed custom malware for use in their operations.^[15][16]

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.^{[10][9][11][12]}

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.^[14]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.^{[3][14][18][27]}

During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.^[11]

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.^[16]

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.^[10][9]

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.^[3][25]

During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.^[9][10]

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.^[17]

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.^{[18][19][20][21]}

Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.^[23]

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.^{[3][24][13][26]}.

Lazarus Group malware KiloAlfa contains keylogging functionality.^[3][13]

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.^[22]

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.^[10][11][12]

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.^[17]

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.^[10][9]

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.^{[30][17][21][22]}

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.^[10][11]

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.^[3][14]

A Lazarus Group malware sample performs reflective DLL injection.^[18][21]

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.^[17]

Lazarus Group malware SierraCharlie uses RDP for propagation.^[3][25]

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.^[22][23]

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.^[9]

For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.^[9]

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.^[11]

For Operation Dream Job, Lazarus Group used compromised servers to host malware.^{[10][9][11][12]}

Lazarus Group has digitally signed malware and utilities to evade detection.^[21]

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.^[9]

During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.^[10]

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.^[10][9]

During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.^[10]

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.^[21]