North Korean state-sponsored hacker group Lazarus exploited Log4Shell vulnerability in South Korean targets in April 2022 · 01.04.2022
North Korean state-sponsored hacker group Lazarus exploited the Log4Shell vulnerability (CVE-2021-44228) in an unpatched VMware Horizon product to place the NukeSped backdoor into South Korean targets in April 2022, according to the technical report of South Korean IT-company AhnLab.
In some cases, the hacker group also used the cryptocurrency malware JimMiner for monetary gains.
Sources cited by EuRepoC (6)
Show 1 more
Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) · 2022-04
Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped)
https://asec.ahnlab.com/en/34461/
Multiple organizations · 19/05/2022
Researchers from Ahnlab discover a new campaign by the North Korean group Lazarus group exploiting the Log4Shell vulnerability (CVE-2021-44228) to install the NukeSped backdoor. [Date Occurred: Since April 2022; Date Discovered: -]
Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) · 2022-05-11
excerpt: In December last year, the vulnerability (CVE-2021-44228) of Java-based logging utility Log4j became a worldwide issue. It is a remote code execution vulnerability that can include the remote Java object address in the log message and send it to the server using Log4j to run the Java object in the server. [Alert] Apache Log4j 2 […] | attribution sentence: [Alert] Apache Log4j 2 Vulnerability, Update Recommended The ASEC analysis team is monitoring the Lazarus group’s attacks on targets in Korea. | target sentence: [Alert] Apache Log4j 2 Vulnerability, Update Recommended The ASEC analysis team is monitoring the Lazarus group’s attacks on targets in Korea.
Log4Shell 취약점을 악용하는 Lazarus 그룹 (NukeSped) · 2022-05-11
excerpt: 작년 12월 자바 기반의 로깅 유틸리티인 Log4j의 취약점(CVE-2021-44228)이 전 세계적으로 이슈가 되었다. 해당 취약점은 원격지의 자바 객체 주소를 로그 메시지에 포함시켜 Log4j를 사용하는 서버에 전송할 경우 서버에서 자바 객체를 실행할 수 있는 원격 코드 실행 취약점이다. Apache Log4j 2 취약점 주의 및 업데이트 권고 – ASEC BLOG Apache Log4j 2 취약점(CVE-2021-44228)이 2021년 12월 10일 POC와 […] | attribution sentence: 취약점… ASEC 분석팀은 Lazarus 그룹의 국내 타겟 공격을 모니터링하고 있으며, 지난 4월 Lazarus 그룹으로 추정되는 공격 그룹이 해당 취약점을 악용하여 NukeSped 악성코드를 유포한 정황을 포착하였다. | target sentence: 취약점… ASEC 분석팀은 Lazarus 그룹의 국내 타겟 공격을 모니터링하고 있으며, 지난 4월 Lazarus 그룹으로 추정되는 공격 그룹이 해당 취약점을 악용하여 NukeSped 악성코드를 유포한 정황을 포착하였다.
Lazarus distributing “NukeSped” malware by exploiting Log4j · April 2022
Para 124: “The same firm discovered in April 2022 that the Lazarus Group had been distributing “NukeSped” malware by exploiting vulnerability in the Java-based logging utility Log4j.”
Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) · 19 May 2022
Annex 53.2 (Links to reports from Ahnlabs ASEC in 2022; Source: Ahnlabs ASEC, annotated by the Panel), listed under “Lazarus Group”: “Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com)” (19 May 2022)