Kaspersky reveals APT group Lazarus’ software exploitation

Kaspersky, a cybersecurity solutions company, has exposed Lazarus’ latest campaign, which exploits legitimate software in a sophisticated APT (Advanced Persistent Threat) strategy. 

The campaign, unveiled by Kaspersky‘s research team at the Security Analyst Summit (SAS), involves malware distributed through authentic software, enabling the notorious Lazarus group to infiltrate organizations worldwide.

“The Lazarus group’s continued activity is a testament to their advanced capabilities and unwavering motivation,” said Seongsu Park, Lead Security Researcher at Kaspersky’s Global Research and Analysis Team. “They operate on a global scale, targeting a wide range of industries with a diverse toolkit of methods. This signifies an ongoing and evolving threat that demands heightened vigilance.”

Lazarus subgroup expands attacks with new ransomware
Kaspersky reveals Lazarus APT group targets vaccine research

According to Kaspersky, Lazarus displayed high-level sophistication by infecting targets through legitimate software intended for encrypting web communication via digital certificates. Despite reported vulnerabilities being patched, many organizations continued using the flawed software version, inadvertently providing an entry point for Lazarus.

Malware

Employing advanced evasion techniques, Lazarus utilized the “SIGNBT” malware to control victims and deployed the well-known LPEClient tool, previously observed targeting defense contractors, nuclear engineers, and the cryptocurrency sector. LPEClient served as the initial infection point, crucial in profiling victims and delivering the malicious payload. Kaspersky researchers observed that the tactics align with Lazarus’ modus operandi, reminiscent of the notorious 3CX supply chain attack.

Further investigation uncovered multiple previous targets of Lazarus, particularly a software vendor. This repetitive targeting suggests a focused adversary, likely aiming to pilfer critical source code or disrupt the software supply chain. Exploiting vulnerabilities in the company’s software, Lazarus widened their attack scope by targeting other entities using the unpatched software version. Kaspersky’s Endpoint Security solution detected and proactively stopped the threat, preventing subsequent attacks against additional targets.

Purchase of Kaspersky products through this link supports this site.