Undisclosed pharmaceutical company

CSIS Significant Cyber Incidents

North Korean hackers targeted a ministry of health and a pharmaceutical company involved in COVID-19 research and response.

EuRepoC

On 27 October 2020, the North Korean Lazarus Group carried out a sophisticated cyber operation on an unspecified Ministry of Health to secretly obtain COVID-19 information. Using "wAgent", a versatile malware, they managed to infiltrate two Windows servers, bypassing existing security measures. wAgent worked mainly in the system's memory and was able to retrieve additional malicious payloads from remote servers, demonstrating its advanced remote control capabilities. The attack was - in proven fashion - highly customised, indicating a targeted approach rather than an indiscriminate large-scale attack. The complexity of the operation was also evident in the persistent access strategy, which utilised malware that mimicked legitimate software components. This tactic ensured that the attackers gained persistent access to the Ministry's systems, which could enable ongoing monitoring or data extraction. The sophistication and execution pattern of this operation - from stealth tactics to persistence - was subsequently linked to the Lazarus Group's known operational methods, confirming their involvement in this high-risk cyber espionage operation in retrospective definitive.

EuRepoC

On 25. September 2020, as part of its "COVID-19 campaign", the Lazarus Group targeted an unnamed pharmaceutical company that was heavily involved in the development of a COVID-19 vaccine. Unlike previous cyber-attacks using the Bookcode malware, the Securelist researchers were unable to reconstruct the exact initial infection vector. This version of Bookcode shared functionality with a report from the Korea Internet & Security Agency (KISA), communicating with the attacker's infrastructure and providing backdoor capabilities. In the post-exploitation phase, the Lazarus Group used this Bookcode cluster with its own tactics, including extracting host information, checking network connectivity, and scanning hosts on the same network after installing Bookcode on 25 September 2020.

ThaiCERT Threat Group Cards

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that actors, such as the Lazarus group, are going after intelligence that could help these efforts by attacking entities related to COVID-19 research. https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Researchers from Kaspersky reveal details on a COVID-19-themed campaign, carried out by the North Korean actor Lazarus Group, and targeting a health ministry.

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Researchers from Kaspersky reveal details on a COVID-19-themed campaign, carried out by the North Korean actor Lazarus Group, and targeting a pharmaceutical company.

Check Point Research

Lazarus group, an APT affiliated with North Korea, has targeted two healthcare entities – Ministry of Health and a pharmaceutical company involved in a COVID-19 vaccine development, probably in order to collect information about the advancements in the pandemic research.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Kaspersky reveal details on a COVID-19-themed campaign, carried out by the North Korean actor Lazarus Group, and targeting a pharmaceutical company. [Date Occurred: 01/09/20; Date Discovered: -]

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Kaspersky reveal details on a COVID-19-themed campaign, carried out by the North Korean actor Lazarus Group, and targeting a health ministry. [Date Occurred: 01/10/20; Date Discovered: -]

Security NEXT (security-next.com)

attribution sentence(s): 「Lazarus」が新コロ研究情報を物色 - 政府や製薬企業に攻撃 | Kasperskyは、北朝鮮が関与するとされる攻撃グループ「Lazarus」が、新型コロナウイルスの研究組織を狙い、サイバー攻撃を展開しているとの見方を示した。 | ヘルスケア分野に関連する海外政府機関や新型コロナウイルスのワクチン製造に関わる製薬会社がサイバー攻撃を受けたもの。利用されたマルウェアの類似性より「Lazarus」との関連性が認められるとして同社では調査を進めているという。

Kaspersky Securelist

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Kaspersky researchers confirm with high confidence that both incidents are connected to the Lazarus group.