Skip to content

G0032 Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.12 The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. 3

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups, such as Andariel, APT37, APT38, and Kimsuky.

Item Value
ID G0032
Associated Names Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY
Version 3.0
Created 31 May 2017
Last Modified 23 March 2022
Navigation Layer View In ATT&CK® Navigator

Associated Group Descriptions

Name Description
Labyrinth Chollima 4
HIDDEN COBRA The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.15
Guardians of Peace 1
ZINC 6
NICKEL ACADEMY 7

Techniques Used

Domain ID Name Use
enterprise T1134 Access Token Manipulation -
enterprise T1134.002 Create Process with Token Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user’s context.39
enterprise T1087 Account Discovery -
enterprise T1087.002 Domain Account Lazarus Group has queried an active directory server to obtain the list of accounts, including administrator accounts.10
enterprise T1098 Account Manipulation Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.316
enterprise T1583 Acquire Infrastructure -
enterprise T1583.001 Domains Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.121013
enterprise T1583.004 Server Lazarus Group has acquired servers to host their malicious tools.10
enterprise T1583.006 Web Services Lazarus Group has hosted malicious downloads on Github and Dropbox.1217
enterprise T1557 Adversary-in-the-Middle -
enterprise T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.11
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Lazarus Group has conducted C2 over HTTP and HTTPS.21282324141520
enterprise T1010 Application Window Discovery Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.389
enterprise T1560 Archive Collected Data Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2. 8222110
enterprise T1560.002 Archive via Library Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.2221
enterprise T1560.003 Archive via Custom Method A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.382221
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.322212414
enterprise T1547.009 Shortcut Modification Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.2117
enterprise T1110 Brute Force Lazarus Group has performed brute force attacks against administrator accounts.10
enterprise T1110.003 Password Spraying Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.322
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell Lazarus Group has used PowerShell to execute commands and malicious code.1013
enterprise T1059.003 Windows Command Shell Lazarus Group malware uses cmd.exe to execute commands on a compromised host.316212615 A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.19
enterprise T1059.005 Visual Basic Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.24171415
enterprise T1584 Compromise Infrastructure -
enterprise T1584.001 Domains Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2.25
enterprise T1584.004 Server Lazarus Group has compromised servers to stage malicious tools.11171024
enterprise T1543 Create or Modify System Process -
enterprise T1543.003 Windows Service Several Lazarus Group malware families install themselves as new services.316
enterprise T1485 Data Destruction Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.3
enterprise T1132 Data Encoding -
enterprise T1132.001 Standard Encoding A Lazarus Group malware sample encodes data with base64.21
enterprise T1005 Data from Local System Lazarus Group has collected data and files from compromised networks.3822111724
enterprise T1001 Data Obfuscation -
enterprise T1001.003 Protocol Impersonation Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.3162119
enterprise T1074 Data Staged -
enterprise T1074.001 Local Data Staging Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.38
enterprise T1491 Defacement -
enterprise T1491.001 Internal Defacement Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.16
enterprise T1140 Deobfuscate/Decode Files or Information Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.1415
enterprise T1587 Develop Capabilities -
enterprise T1587.001 Malware Lazarus Group has developed custom malware for use in their operations.12101317
enterprise T1561 Disk Wipe -
enterprise T1561.001 Disk Content Wipe Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.16
enterprise T1561.002 Disk Structure Wipe Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim’s machine and has possessed MBR wiper malware since at least 2009.263
enterprise T1189 Drive-by Compromise Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.2913
enterprise T1573 Encrypted Channel -
enterprise T1573.001 Symmetric Cryptography Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.316211924
enterprise T1585 Establish Accounts -
enterprise T1585.001 Social Media Accounts Lazarus Group has created new LinkedIn and Twitter accounts to conduct social engineering against potential victims.171013
enterprise T1585.002 Email Accounts Lazarus Group has created new email accounts for spearphishing operations.1011
enterprise T1048 Exfiltration Over Alternative Protocol -
enterprise T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.322
enterprise T1041 Exfiltration Over C2 Channel Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.382125
enterprise T1567 Exfiltration Over Web Service -
enterprise T1567.002 Exfiltration to Cloud Storage Lazarus Group has exfiltrated stolen data to Dropbox using a customized version of dbxcli.1017
enterprise T1203 Exploitation for Client Execution Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.18
enterprise T1008 Fallback Channels Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.322
enterprise T1083 File and Directory Discovery Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest. Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.319171415
enterprise T1589 Gather Victim Identity Information -
enterprise T1589.002 Email Addresses Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.11
enterprise T1591 Gather Victim Org Information Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.101711
enterprise T1591.004 Identify Roles Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements.1017
enterprise T1564 Hide Artifacts -
enterprise T1564.001 Hidden Files and Directories Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.21282314
enterprise T1574 Hijack Execution Flow -
enterprise T1574.002 DLL Side-Loading Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.20
enterprise T1574.013 KernelCallbackTable Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.1415
enterprise T1562 Impair Defenses -
enterprise T1562.001 Disable or Modify Tools Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.38926.
enterprise T1562.004 Disable or Modify System Firewall Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. 389
enterprise T1070 Indicator Removal on Host Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.14
enterprise T1070.003 Clear Command History Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.11
enterprise T1070.004 File Deletion Lazarus Group malware has deleted files in various ways, including “suicide scripts” to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.319
enterprise T1070.006 Timestomp Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.316819
enterprise T1202 Indirect Command Execution Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.15
enterprise T1105 Ingress Tool Transfer Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.316828231711241013141520
enterprise T1056 Input Capture -
enterprise T1056.001 Keylogging Lazarus Group malware KiloAlfa contains keylogging functionality.39
enterprise T1534 Internal Spearphishing Lazarus Group has conducted internal spearphishing from within a compromised organization.17
enterprise T1036 Masquerading Lazarus Group has disguised malicious template files as JPEG files to avoid detection.24
enterprise T1036.003 Rename System Utilities Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.15
enterprise T1036.004 Masquerade Task or Service Lazarus Group has used a scheduled task named SRCheck to mask the execution of a malicious .dll.20
enterprise T1036.005 Match Legitimate Name or Location Lazarus Group has renamed malicious code to disguise it as Microsoft’s narrator and other legitimate files.301015
enterprise T1104 Multi-Stage Channels Lazarus Group has used multi-stage malware components that inject later stages into separate processes.14
enterprise T1106 Native API Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server.24 Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.1415
enterprise T1046 Network Service Discovery Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.11
enterprise T1571 Non-Standard Port Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.322
enterprise T1027 Obfuscated Files or Information Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.38222123102425171415
enterprise T1027.002 Software Packing Lazarus Group has used Themida to pack malicious DLLs and other files.1725
enterprise T1588 Obtain Capabilities -
enterprise T1588.002 Tool Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.101711
enterprise T1588.003 Code Signing Certificates Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools.10
enterprise T1588.004 Digital Certificates Lazarus Group has obtained SSL certificates for their C2 domains.12
enterprise T1566 Phishing -
enterprise T1566.001 Spearphishing Attachment Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.1811241415
enterprise T1566.002 Spearphishing Link Lazarus Group has sent malicious links to victims via email.111710
enterprise T1566.003 Spearphishing via Service Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.131710
enterprise T1542 Pre-OS Boot -
enterprise T1542.003 Bootkit Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.316
enterprise T1057 Process Discovery Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.3821192314
enterprise T1055 Process Injection -
enterprise T1055.001 Dynamic-link Library Injection A Lazarus Group malware sample performs reflective DLL injection.2114
enterprise T1090 Proxy -
enterprise T1090.001 Internal Proxy Lazarus Group has used a compromised router to serve as a proxy between a victim network’s corporate and restricted segments.11
enterprise T1090.002 External Proxy Lazarus Group has used multiple proxies to obfuscate network traffic from victims.2723
enterprise T1012 Query Registry Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.3821
enterprise T1620 Reflective Code Loading Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.1415
enterprise T1021 Remote Services -
enterprise T1021.001 Remote Desktop Protocol Lazarus Group malware SierraCharlie uses RDP for propagation.322
enterprise T1021.002 SMB/Windows Admin Shares Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.322
enterprise T1021.004 SSH Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.11
enterprise T1053 Scheduled Task/Job -
enterprise T1053.005 Scheduled Task Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.101520
enterprise T1593 Search Open Websites/Domains -
enterprise T1593.001 Social Media Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization.1017
enterprise T1489 Service Stop Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.16
enterprise T1608 Stage Capabilities -
enterprise T1608.001 Upload Malware Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers.171025
enterprise T1608.002 Upload Tool Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers.10
enterprise T1553 Subvert Trust Controls -
enterprise T1553.002 Code Signing Lazarus Group has digitally signed malware and utilities to evade detection.1014
enterprise T1218 System Binary Proxy Execution Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.1415
enterprise T1218.005 Mshta Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.1415
enterprise T1218.010 Regsvr32 Lazarus Group has used rgsvr32 to execute custom malware.10
enterprise T1218.011 Rundll32 Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.241020
enterprise T1082 System Information Discovery Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.3168211914
enterprise T1614 System Location Discovery -
enterprise T1614.001 System Language Discovery Lazarus Group has deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.17
enterprise T1016 System Network Configuration Discovery Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.38
enterprise T1049 System Network Connections Discovery Lazarus Group has used net use to identify and establish a network connection with a remote host.11
enterprise T1033 System Owner/User Discovery Various Lazarus Group malware enumerates logged-on users.316822212814
enterprise T1529 System Shutdown/Reboot Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.26
enterprise T1124 System Time Discovery A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.19
enterprise T1221 Template Injection Lazarus Group has used DOCX files to retrieve a malicious document template/DOTM file.1724
enterprise T1204 User Execution -
enterprise T1204.001 Malicious Link Lazarus Group has sent spearphishing emails in an attempt to lure users to click on a malicious link.1017
enterprise T1204.002 Malicious File Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.1817111415
enterprise T1078 Valid Accounts Lazarus Group has used administrator credentials to gain access to restricted network segments.11
enterprise T1497 Virtualization/Sandbox Evasion -
enterprise T1497.001 System Checks Lazarus Group has used tools to detect sandbox or VMware services through identifying the presence of a debugger or related services.17
enterprise T1102 Web Service -
enterprise T1102.002 Bidirectional Communication Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.14
enterprise T1047 Windows Management Instrumentation Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.322171115
enterprise T1220 XSL Script Processing Lazarus Group has used WMIC to execute a remote XSL script to establish persistence.10

Software

ID Name References Techniques
S0584 AppleJeus 12 Bypass User Account Control:Abuse Elevation Control Mechanism Web Protocols:Application Layer Protocol Unix Shell:Command and Scripting Interpreter Windows Service:Create or Modify System Process Launch Daemon:Create or Modify System Process Deobfuscate/Decode Files or Information Exfiltration Over C2 Channel Hidden Files and Directories:Hide Artifacts File Deletion:Indicator Removal on Host Obfuscated Files or Information Spearphishing Link:Phishing Scheduled Task:Scheduled Task/Job Code Signing:Subvert Trust Controls Msiexec:System Binary Proxy Execution System Information Discovery Launchctl:System Services Malicious Link:User Execution Malicious File:User Execution Time Based Evasion:Virtualization/Sandbox Evasion
S0347 AuditCred - Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Windows Service:Create or Modify System Process Deobfuscate/Decode Files or Information File and Directory Discovery File Deletion:Indicator Removal on Host Ingress Tool Transfer Obfuscated Files or Information Process Injection Proxy
S0245 BADCALL - Commonly Used Port Protocol Impersonation:Data Obfuscation Symmetric Cryptography:Encrypted Channel Disable or Modify System Firewall:Impair Defenses Modify Registry Non-Standard Port Proxy System Information Discovery System Network Configuration Discovery
S0239 Bankshot - Create Process with Token:Access Token Manipulation Domain Account:Account Discovery Local Account:Account Discovery Web Protocols:Application Layer Protocol Automated Collection Windows Command Shell:Command and Scripting Interpreter Windows Service:Create or Modify System Process Non-Standard Encoding:Data Encoding Data from Local System Protocol Impersonation:Data Obfuscation Deobfuscate/Decode Files or Information Exfiltration Over C2 Channel Exploitation for Client Execution File and Directory Discovery Timestomp:Indicator Removal on Host File Deletion:Indicator Removal on Host Indicator Removal on Host Ingress Tool Transfer Modify Registry Native API Non-Standard Port Process Discovery Query Registry System Information Discovery
S0520 BLINDINGCAN - Web Protocols:Application Layer Protocol Windows Command Shell:Command and Scripting Interpreter Standard Encoding:Data Encoding Data from Local System Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel File and Directory Discovery File Deletion:Indicator Removal on Host Timestomp:Indicator Removal on Host Ingress Tool Transfer Match Legitimate Name or Location:Masquerading Obfuscated Files or Information Software Packing:Obfuscated Files or Information Spearphishing Attachment:Phishing Shared Modules Code Signing:Subvert Trust Controls Rundll32:System Binary Proxy Execution System Information Discovery System Network Configuration Discovery Malicious File:User Execution
S0498 Cryptoistic - Data from Local System Encrypted Channel File and Directory Discovery File Deletion:Indicator Removal on Host Ingress Tool Transfer Non-Application Layer Protocol System Owner/User Discovery
S0497 Dacls - Web Protocols:Application Layer Protocol Launch Agent:Create or Modify System Process Launch Daemon:Create or Modify System Process File and Directory Discovery Hidden Files and Directories:Hide Artifacts Ingress Tool Transfer Masquerading Obfuscated Files or Information Process Discovery
S0567 Dtrack - Archive Collected Data Boot or Logon Autostart Execution Browser Bookmark Discovery Windows Command Shell:Command and Scripting Interpreter Windows Service:Create or Modify System Process Data from Local System Local Data Staging:Data Staged Deobfuscate/Decode Files or Information File and Directory Discovery Hijack Execution Flow File Deletion:Indicator Removal on Host Ingress Tool Transfer Keylogging:Input Capture Match Legitimate Name or Location:Masquerading Obfuscated Files or Information Process Discovery Process Hollowing:Process Injection Query Registry Shared Modules System Information Discovery System Network Configuration Discovery System Network Connections Discovery Valid Accounts
S0593 ECCENTRICBANDWAGON - Windows Command Shell:Command and Scripting Interpreter Local Data Staging:Data Staged File Deletion:Indicator Removal on Host Keylogging:Input Capture Obfuscated Files or Information Screen Capture
S0181 FALLCHILL - Windows Service:Create or Modify System Process Protocol Impersonation:Data Obfuscation Symmetric Cryptography:Encrypted Channel File and Directory Discovery Timestomp:Indicator Removal on Host File Deletion:Indicator Removal on Host System Information Discovery System Network Configuration Discovery
S0246 HARDRAIN - Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Protocol Impersonation:Data Obfuscation Disable or Modify System Firewall:Impair Defenses Non-Standard Port Proxy
S0376 HOPLIGHT - Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Standard Encoding:Data Encoding Exfiltration Over C2 Channel Fallback Channels File and Directory Discovery Disable or Modify System Firewall:Impair Defenses Ingress Tool Transfer Modify Registry Non-Standard Port Security Account Manager:OS Credential Dumping Process Injection Proxy Query Registry System Information Discovery Service Execution:System Services System Time Discovery Pass the Hash:Use Alternate Authentication Material Windows Management Instrumentation
S0431 HotCroissant - Application Window Discovery Windows Command Shell:Command and Scripting Interpreter Symmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel File and Directory Discovery Hidden Window:Hide Artifacts File Deletion:Indicator Removal on Host Ingress Tool Transfer Native API Obfuscated Files or Information Software Packing:Obfuscated Files or Information Process Discovery Scheduled Task:Scheduled Task/Job Screen Capture Service Stop Software Discovery System Information Discovery System Network Configuration Discovery System Owner/User Discovery System Service Discovery
S0271 KEYMARBLE - Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Symmetric Cryptography:Encrypted Channel File and Directory Discovery File Deletion:Indicator Removal on Host Ingress Tool Transfer Modify Registry Process Discovery Screen Capture System Information Discovery System Network Configuration Discovery
S0108 netsh - Netsh Helper DLL:Event Triggered Execution Disable or Modify System Firewall:Impair Defenses Proxy Security Software Discovery:Software Discovery
S0238 Proxysvc - Web Protocols:Application Layer Protocol Automated Collection Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Data Destruction Data from Local System Exfiltration Over C2 Channel File and Directory Discovery File Deletion:Indicator Removal on Host Process Discovery Query Registry System Information Discovery System Network Configuration Discovery Service Execution:System Services System Time Discovery
S0241 RATANKBA - Local Account:Account Discovery Web Protocols:Application Layer Protocol Windows Command Shell:Command and Scripting Interpreter PowerShell:Command and Scripting Interpreter Commonly Used Port Ingress Tool Transfer Process Discovery Dynamic-link Library Injection:Process Injection Query Registry Remote System Discovery System Information Discovery System Network Configuration Discovery System Network Connections Discovery System Owner/User Discovery System Service Discovery Windows Management Instrumentation
S0364 RawDisk - Data Destruction Disk Structure Wipe:Disk Wipe Disk Content Wipe:Disk Wipe
S0174 Responder - LLMNR/NBT-NS Poisoning and SMB Relay:Adversary-in-the-Middle Network Sniffing
S0103 route - System Network Configuration Discovery
S0586 TAINTEDSCRIBE - Archive Collected Data Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Windows Command Shell:Command and Scripting Interpreter Protocol Impersonation:Data Obfuscation Symmetric Cryptography:Encrypted Channel Fallback Channels File and Directory Discovery File Deletion:Indicator Removal on Host Timestomp:Indicator Removal on Host Ingress Tool Transfer Match Legitimate Name or Location:Masquerading Binary Padding:Obfuscated Files or Information Process Discovery Remote System Discovery System Information Discovery System Time Discovery
S0665 ThreatNeedle - Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Windows Service:Create or Modify System Process Data from Local System Deobfuscate/Decode Files or Information File and Directory Discovery Ingress Tool Transfer Match Legitimate Name or Location:Masquerading Modify Registry Obfuscated Files or Information Spearphishing Attachment:Phishing System Information Discovery Malicious File:User Execution
S0678 Torisma - Web Protocols:Application Layer Protocol Standard Encoding:Data Encoding Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Execution Guardrails Exfiltration Over C2 Channel Native API Obfuscated Files or Information Software Packing:Obfuscated Files or Information System Information Discovery System Network Configuration Discovery System Network Connections Discovery System Time Discovery
S0263 TYPEFRAME - Windows Command Shell:Command and Scripting Interpreter Visual Basic:Command and Scripting Interpreter Commonly Used Port Windows Service:Create or Modify System Process Deobfuscate/Decode Files or Information File and Directory Discovery Disable or Modify System Firewall:Impair Defenses File Deletion:Indicator Removal on Host Ingress Tool Transfer Modify Registry Non-Standard Port Obfuscated Files or Information Proxy System Information Discovery Malicious File:User Execution
S0180 Volgmer - Windows Command Shell:Command and Scripting Interpreter Commonly Used Port Windows Service:Create or Modify System Process Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Asymmetric Cryptography:Encrypted Channel File and Directory Discovery File Deletion:Indicator Removal on Host Ingress Tool Transfer Masquerade Task or Service:Masquerading Modify Registry Native API Obfuscated Files or Information Process Discovery Query Registry System Information Discovery System Network Configuration Discovery System Network Connections Discovery System Service Discovery
S0366 WannaCry - Windows Service:Create or Modify System Process Data Encrypted for Impact Asymmetric Cryptography:Encrypted Channel Exploitation of Remote Services File and Directory Discovery Windows File and Directory Permissions Modification:File and Directory Permissions Modification Hidden Files and Directories:Hide Artifacts Inhibit System Recovery Lateral Tool Transfer Peripheral Device Discovery Multi-hop Proxy:Proxy RDP Hijacking:Remote Service Session Hijacking Remote System Discovery Service Stop System Network Configuration Discovery Windows Management Instrumentation

References


  1. US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure. Retrieved July 13, 2017. 

  2. US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021. 

  3. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. 

  4. CrowdStrike. (2022, February 1). CrowdStrike Adversary Labyrinth Chollima. Retrieved February 1, 2022. 

  5. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019. 

  6. Smith, B. (2017, December 19). Microsoft and Facebook disrupt ZINC malware attack to protect customers and the internet from ongoing cyberthreats. Retrieved December 20, 2017. 

  7. Secureworks. (2017, December 15). Media Alert - Secureworks Discovers North Korean Cyber Threat Group, Lazarus, Spearphishing Financial Executives of Cryptocurrency Companies. Retrieved December 27, 2017. 

  8. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016. 

  9. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Tools Report. Retrieved March 10, 2016. 

  10. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021. 

  11. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. 

  12. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021. 

  13. Weidemann, A. (2021, January 25). New campaign targeting security researchers. Retrieved December 20, 2021. 

  14. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. 

  15. Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022. 

  16. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. 

  17. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. 

  18. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. 

  19. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018. 

  20. Cherepanov, Anton. (2019, November 10). ESETresearch discovered a trojanized IDA Pro installer. Retrieved March 2, 2022. 

  21. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018. 

  22. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016. 

  23. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020. 

  24. Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021. 

  25. Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021. 

  26. US-CERT. (2018, March 09). Malware Analysis Report (MAR) - 10135536.11.WHITE. Retrieved June 13, 2018. 

  27. US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017. 

  28. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020. 

  29. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018. 

  30. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021. 

  31. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018. 

  32. US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020. 

  33. US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020. 

  34. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018. 

  35. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018. 

  36. Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved March 25, 2019. 

  37. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019. 

  38. Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019. 

  39. Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021. 

  40. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018. 

  41. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018. 

  42. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018. 

  43. Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021. 

  44. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017. 

  45. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018. 

Back to top