Kaspersky ThreatNeedle Feb 2021

ThreatNeedle can collect data and files from a compromised host.

Lazarus Group has collected data and files from compromised networks.

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.

ThreatNeedle has been compressed and obfuscated.

ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

Lazarus Group has used net use to identify and establish a network connection with a remote host.

Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.

Lazarus Group has used administrator credentials to gain access to restricted network segments.

ThreatNeedle can collect system profile information from a compromised host.

ThreatNeedle can obtain file and directory information.

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

ThreatNeedle can download additional tools to enable lateral movement.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

ThreatNeedle can modify the Registry to save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.

ThreatNeedle relies on a victim to click on a malicious document for initial execution.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

ThreatNeedle can run in memory and register its payload as a Windows service.

ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.

Lazarus Group has sent malicious links to victims via email.

Lazarus Group has compromised servers to stage malicious tools.

Lazarus Group has created new email accounts for spearphishing operations.

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.