Lazarus Group's infrastructure reuse leads to discovery of new malware

EuRepoC

The North Korean state-sponsored hacking group 'Lazarus' started a campaign against Internet infrastructure providers and healthcare entities in Europe and the United States in early 2023. According to Cisco Talos, Lazarus has been exploiting the ManageEngine ServiceDesk vulnerability CVE-2022-47966 shortly after it was publicly disclosed in January 2023. The attackers used this vulnerability to deploy malware, including QuietRAT and CollectionRAT.

ThaiCERT Threat Group Cards

Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT https://blog.talosintelligence.com/lazarus-quiterat/

CFR Cyber Operations Tracker

Lazarus Group deployed a new variety of remote-access Trojan, dubbed QuiteRAT, on the networks of a European internet backbone infrastructure provider.

Cisco Talos blog

In early 2023, we observed Lazarus Group successfully compromise an internet backbone infrastructure provider in Europe to successfully deploy QuiteRAT. The actors exploited a vulnerable ManageEngine ServiceDesk instance to gain initial access.

Cisco Talos blog

In the new Lazarus Group campaign we recently disclosed, the North Korean state-sponsored actor continues to use much of the same infrastructure despite those components being well-documented by security researchers over the years.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from CIsco Talos reveal that the North Korean state-backed hacker group tracked as Lazarus has been exploiting a critical vulnerability (CVE-2022-47966) in Zoho's ManageEngine ServiceDesk to compromise an internet backbone infrastructure provider and healthcare organizations with the QuiteRAT malware and a newly discovered remote access trojan (RAT) dubbed CollectionRAT. [Date Occurred: Early 2023; Date Discovered: Early 2023]

UN Panel of Experts S/2024/215

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 33 of 75, PDF p. 324). DPRK cyber actor: Lazarus Group; Report Name: Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT; Case Summary: Lazarus Group has been targeting internet backbone infrastructure and healthcare entities in Europe and the United States. The actors exploited a ManageEngine ServiceDesk vulnerability (CVE-2022-47966) five days after PoCs for the exploit were publicly disclosed to deliver and deploy a newer malware threat “QuiteRAT.”; Publication Month: August

Cisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States.