{"id":18137,"date":"2022-02-02T11:11:01","date_gmt":"2022-02-02T19:11:01","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11870\/"},"modified":"2022-02-02T11:11:01","modified_gmt":"2022-02-02T19:11:01","slug":"news-11870","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11870\/","title":{"rendered":"North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign"},"content":{"rendered":"

Credit to Author: Threat Intelligence Team| Date: Thu, 27 Jan 2022 16:20:16 +0000<\/strong><\/p>\n

This blog was authored by Ankur Saini and Hossein Jazi<\/em><\/p>\n

Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team is actively monitoring its activities and was able to spot a new campaign<\/a> on Jan 18th 2022. <\/p>\n

In this campaign, Lazarus conducted spear phishing attacks weaponized with malicious documents that use their known job opportunities theme<\/a>. We identified two decoy documents masquerading as American global security and aerospace giant Lockheed Martin. <\/p>\n

In this blog post, we provide technical analysis of this latest attack including a clever use of Windows Update to execute the malicious payload and GitHub as a command and control server. We have reported the rogue GitHub account for harmful content.<\/p>\n

Analysis<\/h2>\n

The two macro-embedded documents seem to be luring the targets about new job opportunities at Lockheed Martin:<\/p>\n