Lazarus Group targeted Windows IIS Web Servers in Global Campaign · Not available
On 23 May 2023, the AhnLab Security Emergency Response Center (ASEC) reported on a recent discovery of activity by the Lazarus group, linked to North Korea, targeting vulnerable versions of Microsoft Internet Information Services (IIS) servers to install malware.
Using DLL side-loading techniques, the threat actor places a malicious DLL (msvcr100.dll) alongside a legitimate application (Wordconv.exe) in the same file path. When the application runs, the malicious DLL is triggered, allowing an encrypted payload to be decrypted and run in memory. The group pursued a variety of attack vectors, including Log4Shell, public certificate vulnerabilities, and distribution channels uncovered as part of the 3CX supply chain attack. Publication of the ASEC report coincided with additional sanctions against entities and individuals involved in supporting North Korea's cyber activities communicated by the US Treasury Department on 23 May.
On 29 June, the UK National Cyber Security Centre (NCSC) published a malware analysis report on "Smooth Operator", the mac os supply chain malware used by Lazarus.
Sources cited by EuRepoC (15)
Show 10 more
Lazarus Group Targeting Windows IIS Web Servers · 2023-05
Lazarus Group Targeting Windows IIS Web Servers
https://asec.ahnlab.com/en/53132/
Multiple organizations · 23/05/2023
Researchers from AhnLab reveal that the notorious North Korean state-backed group, known as the Lazarus Group, is now targeting vulnerable Windows Internet Information Services (IIS) web servers to gain initial access to corporate networks. [Date Occurred: -; Date Discovered: -]
Lazarus Group Targeting Windows IIS Web Servers · 2023-05-17
excerpt: AhnLab Security Emergency response Center (ASEC) has recently confirmed the Lazarus group, a group known to receive support on a national scale, carrying out attacks against Windows IIS web servers. Ordinarily, when threat actors perform a scan and find a web server with a vulnerable version, they use the vulnerability suitable for the version to […] | attribution sentence: AhnLab Security Emergency response Center (ASEC) has recently confirmed the Lazarus group, a group known to receive support on a national scale, carrying out attacks against Windows IIS web servers. | target sentence: The AhnLab Smart Defense (ASD) log displayed below in Figure 1 shows that Windows server systems are being targeted for attacks, and malicious behaviors are being carried out through w3wp.exe, an IIS web server process.
취약한 윈도우 IIS 웹 서버를 노리는 Lazarus 그룹 · 2023-05-17
excerpt: AhnLab Security Emergency response Center(ASEC)은 국가 차원의 지원을 받는 공격 그룹으로 알려진 Lazarus 그룹이 최근 윈도우 IIS 웹 서버를 대상으로 공격을 수행한 것을 확인하였다. 일반적으로 공격자들은 스캐닝 결과 취약한 버전을 갖는 웹 서버가 확인되면 버전에 맞는 취약점을 이용해 웹쉘을 설치하거나 악성 명령을 실행한다. 아래 [그림 1]의 자사 AhnLab Smart Defense(ASD) 로그를 보면 공격 대상이 윈도우 […] | attribution sentence: AhnLab Security Emergency response Center(ASEC)은 국가 차원의 지원을 받는 공격 그룹으로 알려진 Lazarus 그룹이 최근 윈도우 IIS 웹 서버를 대상으로 공격을 수행한 것을 확인하였다. | target sentence: AhnLab Security Emergency response Center(ASEC)은 국가 차원의 지원을 받는 공격 그룹으로 알려진 Lazarus 그룹이 최근 윈도우 IIS 웹 서버를 대상으로 공격을 수행한 것을 확인하였다.
Attacks against Windows IIS web servers (DLL side-loading, msvcr100.dll); anti-forensic techniques · May 2023 (report)
Annex 67, Case 2: “Another cybersecurity company reported in May 2023 that the Lazarus Group has been carrying out attacks against Windows IIS web servers by placing a malicious DLL (msvcr100.dll) in the folder path as a normal application through the web servers’ process. ... In addition, the Lazarus Group has also been using anti-forensic techniques to conceal its activity, including hiding and encrypting data, file deletion and timestamp changes.”
Lazarus Group Targetting Windows IIS Web Servers · 23 May 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Lazarus Group”: “Lazarus Group Targetting Windows IIS Web Servers” (23 May 2023)