Novetta Blockbuster RATs

Lazarus Group has collected data and files from compromised networks.

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.

Lazarus Group malware SierraCharlie uses RDP for propagation.

Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Various Lazarus Group malware enumerates logged-on users.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.