G0032: Lazarus Group

Lazarus Group malware uses cmd.exe to execute commands on a compromised host.[3]CitationNovetta Blockbuster Destructive MalwareCitationMcAfee Lazarus Resurfaces Feb 2018CitationUS-CERT SHARPKNOT June 2018CitationQualys LolZarus A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.CitationMcAfee GhostSecret

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.CitationMcAfee BankshotCitationKaspersky ThreatNeedle Feb 2021CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.CitationQualys LolZarus

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.[3]CitationNovetta Blockbuster RATs

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.[3]CitationNovetta Blockbuster Destructive MalwareCitationMcAfee Lazarus Resurfaces Feb 2018CitationMcAfee-GhostSecret-fixurl

Lazarus Group has compromised servers to stage malicious tools.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.[3]CitationNovetta Blockbuster Destructive MalwareCitationNovetta Blockbuster LoadersCitationSentinelOne Lazarus macOS July 2020CitationTrendMicro macOS Dacls May 2020CitationKaspersky ThreatNeedle Feb 2021CitationGoogle TAG Lazarus Jan 2021CitationLazarus APT January 2022CitationQualys LolZarusCitationESET Twitter Ida Pro Nov 2021

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.[3]CitationNovetta Blockbuster LoadersCitationNovetta Blockbuster Tools

Lazarus Group has developed custom malware for use in their operations.CitationCISA AppleJeus Feb 2021CitationGoogle TAG Lazarus Jan 2021

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.[3]CitationNovetta Blockbuster Tools

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.[3]CitationNovetta Blockbuster Destructive Malware

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.CitationMcAfee Lazarus Resurfaces Feb 2018CitationSentinelOne Lazarus macOS July 2020CitationTrendMicro macOS Dacls May 2020CitationLazarus APT January 2022

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.[3]

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server.CitationMcAfee Lazarus Jul 2020 Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group has used administrator credentials to gain access to restricted network segments.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has distributed malicious payloads embedded in PNG files.CitationMicrosoft DiamondSleet 2023

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.[3]CitationNovetta Blockbuster LoadersCitationMcAfee Lazarus Resurfaces Feb 2018

Lazarus Group has used multiple proxies to obfuscate network traffic from victims.CitationUS-CERT FALLCHILL Nov 2017CitationTrendMicro macOS Dacls May 2020

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.[3]CitationNovetta Blockbuster LoadersCitationNovetta Blockbuster RATsCitationMcAfee Lazarus Resurfaces Feb 2018CitationTrendMicro macOS Dacls May 2020CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group has used multi-stage malware components that inject later stages into separate processes.CitationLazarus APT January 2022

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has collected data and files from compromised networks.[3]CitationNovetta Blockbuster LoadersCitationNovetta Blockbuster RATsCitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.CitationNovetta Blockbuster Destructive Malware

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.[3]CitationNovetta Blockbuster Loaders

Lazarus Group has obtained SSL certificates for their C2 domains.CitationCISA AppleJeus Feb 2021

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.[3]CitationNovetta Blockbuster Destructive MalwareCitationMcAfee Lazarus Resurfaces Feb 2018CitationMcAfee GhostSecret

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.[3]CitationNovetta Blockbuster Destructive MalwareCitationNovetta Blockbuster LoadersCitationMcAfee Lazarus Resurfaces Feb 2018CitationMcAfee GhostSecretCitationLazarus APT January 2022

Various Lazarus Group malware enumerates logged-on users.[3]CitationNovetta Blockbuster Destructive MalwareCitationNovetta Blockbuster LoadersCitationNovetta Blockbuster RATsCitationMcAfee Lazarus Resurfaces Feb 2018CitationSentinelOne Lazarus macOS July 2020CitationLazarus APT January 2022

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.[3]CitationNovetta Blockbuster LoadersCitationMcAfee Lazarus Resurfaces Feb 2018

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.CitationLazarus APT January 2022

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2. CitationNovetta Blockbuster LoadersCitationNovetta Blockbuster RATsCitationMcAfee Lazarus Resurfaces Feb 2018

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.CitationMcAfee Bankshot

Lazarus Group has used PowerShell to execute commands and malicious code.CitationGoogle TAG Lazarus Jan 2021

Lazarus Group has sent malicious links to victims via email.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.[3]CitationNovetta Blockbuster Loaders

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.CitationQualys LolZarus

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.[3]CitationNovetta Blockbuster RATsCitationKaspersky ThreatNeedle Feb 2021CitationQualys LolZarus

Lazarus Group has conducted C2 over HTTP and HTTPS.CitationMcAfee Lazarus Resurfaces Feb 2018CitationSentinelOne Lazarus macOS July 2020CitationTrendMicro macOS Dacls May 2020CitationLazarus APT January 2022CitationQualys LolZarusCitationESET Twitter Ida Pro Nov 2021

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.CitationKaspersky ThreatNeedle Feb 2021

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[3]CitationNovetta Blockbuster LoadersCitationMcAfee Lazarus Resurfaces Feb 2018CitationMcAfee GhostSecretCitationTrendMicro macOS Dacls May 2020CitationLazarus APT January 2022

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.[3]CitationNovetta Blockbuster RATsCitationMcAfee Lazarus Resurfaces Feb 2018CitationLazarus APT January 2022

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.[3]CitationNovetta Blockbuster LoadersCitationNovetta Blockbuster ToolsCitationUS-CERT SHARPKNOT June 2018.

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.CitationNovetta Blockbuster Destructive Malware

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.CitationNovetta Blockbuster Destructive Malware

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.CitationKaspersky ThreatNeedle Feb 2021

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.CitationMcAfee Lazarus Resurfaces Feb 2018

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.[3]CitationNovetta Blockbuster Destructive Malware

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.CitationESET Twitter Ida Pro Nov 2021

Lazarus Group has hosted malicious downloads on Github.CitationCISA AppleJeus Feb 2021

Lazarus Group malware KiloAlfa contains keylogging functionality.[3]CitationNovetta Blockbuster Tools

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.[3]CitationNovetta Blockbuster RATs

A Lazarus Group malware sample encodes data with base64.CitationMcAfee Lazarus Resurfaces Feb 2018

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.CitationRATANKBACitationGoogle TAG Lazarus Jan 2021

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.[3]CitationNovetta Blockbuster RATs

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.CitationMcAfee BankshotCitationKaspersky ThreatNeedle Feb 2021CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group has digitally signed malware and utilities to evade detection.CitationLazarus APT January 2022

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.CitationLazarus APT January 2022CitationQualys LolZarus

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.CitationNovetta Blockbuster RATsCitationMcAfee Lazarus Resurfaces Feb 2018