Lazarus Group

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.^[3][7]

Lazarus Group has acquired infrastructure related to their campaigns to act as distribution points and C2 channels.^[9]

Lazarus Group malware has conducted C2 over HTTP and HTTPS.^[10][11][12]

Lazarus Group malware attempts to maintain persistence by saving itself in the Start menu folder or by adding a Registry Run key.^[3][14][10]

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.^[3][14]

Lazarus Group malware uses cmd.exe to execute commands on victims.^{[3][8][10][15]} A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[16]

Several Lazarus Group malware families install themselves as new services on victims.^[3][8]

A Lazarus Group malware sample encodes data with base64.^[10]

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.^{[3][8][10][16]}

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.^[3][13]

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe^[17][8]

Lazarus Group has developed several custom malware for use in operations.^[9]

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.^[8]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.^{[3][8][10][16]}

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.^[3][14]

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.^[10][11][12]

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.^{[3][13][7][15]}.

Lazarus Group malware deletes files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.^[3][16]

Lazarus Group malware KiloAlfa contains keylogging functionality.^[3][7]

Lazarus Group has renamed the TAINTEDSCRIBE main executable to disguise itself as Microsoft's narrator.^[20]

Lazarus Group has obtained SSL certificates for their C2 domains.^[9]

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.^[19]

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.^[3][8]

A Lazarus Group malware sample performs reflective DLL injection.^[10]

Lazarus Group uses multiple proxies to obfuscate network traffic from victims.^[21][12]

Lazarus Group malware SierraCharlie uses RDP for propagation.^[3][14]

Lazarus Group has used CHM files to move concealed payloads.^[22]

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.^[19]