According to experts at a cyber security agency, Lazarus, a notable hacking organization with ties to the North Korean government, has been utilizing the Windows Update client to spread malware as part of a new spear-phishing effort.
The North Korean nation-state hacking outfit known as the Lazarus Group, formerly as APT38, Hidden Cobra, Whois Hacking Team, and Zinc, has been operating since at least 2009. The threat actor was tied to a sophisticated social engineering campaign aimed at security experts last year.
The two macro-embedded messages seem to be enticing the targets about new Lockheed Martin job opportunities:
- Lockheed Martin JobOpportunities.docx
- Salary Lockheed Martin job opportunities confidential.doc
Both of these documents were created on April 24, 2020, but enough evidence leads us to believe it was leveraged in a campaign between late December 2021 and early 2022. The threat actor's domains are one of the pieces of evidence that this attack took place recently. The attack begins with the malicious macros hidden in the Word document being executed.
The malware executes a series of implants in order to gain startup persistence on the target computer and inserts code into the computer's restart system to ensure a restart does not knock down the virus.
Researchers discovered evidence that the threat group used GitHub as a command and control (C2) site for its attacks. Lazarus' use of GitHub as a C2 is unusual, according to the researchers, who claim this is the first time a group is seen to be doing so. The threat group was found to be utilizing GitHub as a command and control (C2) site for its attacks. According to the researchers, Lazarus' usage of GitHub as a C2 is uncommon.
The campaign's attribution to the Lazarus APT is based on different facts as stated below:
- The usage of employment opportunities as a template is something Lazarus has done before.
- Defense industry targets, particularly Lockheed Martin, are well-known targets for North Korean-linked APT.
- The metadata utilized in this campaign connects the documents to various other materials used by Lazarus previously.
