Procedure examples

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.

Lazarus Group has collected data and files from compromised networks.

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.

Lazarus Group malware SierraCharlie uses RDP for propagation.

Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.

Lazarus Group has distributed malicious payloads embedded in PNG files.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Various Lazarus Group malware enumerates logged-on users.

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.

Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.

Lazarus Group has used net use to identify and establish a network connection with a remote host.

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

A Lazarus Group malware sample performs reflective DLL injection.

Lazarus Group malware KiloAlfa contains keylogging functionality.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Lazarus Group has used PowerShell to execute commands and malicious code.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.

Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Lazarus Group has conducted C2 over HTTP and HTTPS.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.

Lazarus Group has used administrator credentials to gain access to restricted network segments.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

Lazarus Group has used multiple proxies to obfuscate network traffic from victims.

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.

Lazarus Group has used multi-stage malware components that inject later stages into separate processes.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.

A Lazarus Group malware sample encodes data with base64.

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.