Procedure examples

Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.

Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.

Several Lazarus Group malware families install themselves as new services.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.

Lazarus Group has digitally signed malware and utilities to evade detection.

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.

Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

Lazarus Group has sent malicious links to victims via email.

Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload. Lazarus Group utilized DLL side-loading to execute malicious payloads through abuse of the legitimate processes `wsmprovhost.exe` and `dfrgui.exe`.

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.

Lazarus Group has hosted malicious downloads on Github.

Lazarus Group has compromised servers to stage malicious tools.

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.

Lazarus Group has created new email accounts for spearphishing operations.

Lazarus Group has developed custom malware for use in their operations.

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.

Lazarus Group has obtained SSL certificates for their C2 domains.

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..

Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.