DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021

Date (as written)
01.10.2021
Year
2021
Country
Netherlands
Actors (as written)
Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
Actor pages
Lazarus GroupLabyrinth ChollimaHIDDEN COBRAGuardians of PeaceDiamond Sleet fka ZINCNICKEL ACADEMYNewRomanic Cyber Army TeamWhois Hacking TeamApplewormGroup 77G0032
Tags (as written)
Hijacking with Misuse

Source entries (3)

EuRepoC

North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 · 01.10.2021
North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands for data exfiltration purposes in autumn 2021, attributed by IT-security company ESET with high confidence. The hacker group used the Dell firmware exploit (CVE-2021-21551) to deploy various malware. In a related case, the attempt to gain access to the computer of a Belgian political journalist was stopped.
Sources cited by EuRepoC (12)
https://securitymea.com/2023/02/09/eset-threat-reports-on-russian-invasions-impact-on-digital-threats/
https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/
https://twitter.com/Cyber_O51NT/status/1639428701137035264
https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/
https://www.bleepingcomputer.com/news/security/lazarus-hackers-abuse-dell-driver-bug-using-new-fudmodule-rootkit/
Show 7 more
https://research.checkpoint.com/2022/3rd-october-threat-intelligence-report/
https://twitter.com/cybersecboardrm/status/1576976076860973056
https://thehackernews.com/2022/10/hackers-exploiting-dell-driver.html
https://securityaffairs.co/wordpress/136623/apt/lazarus-exploit-dell-firmware-driver.html
https://www.securityweek.com/north-korean-hackers-exploit-dell-driver-vulnerability-disable-windows-security
https://www.virusbulletin.com/uploads/pdf/conference/vb2022/VB2022-Kalnai-Havranek.pdf
https://socradar.io/apt-group-lazarus-exploits-high-severity-flaw-in-dell-driver/

ThaiCERT Threat Group Cards

Amazon‑themed campaigns of Lazarus in the Netherlands and Belgium · 2021 Autumn
Amazon‑themed campaigns of Lazarus in the Netherlands and Belgium https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/
https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/

UN Panel of Experts S/2024/215

Attacks on aerospace companies in the Kingdom of the Netherlands · October 2021
Para 131: “The Lazarus Group reportedly attacked aerospace companies in the Kingdom of the Netherlands in October 2021 and a defence company in Poland in February 2023 through similar methods.”
https://undocs.org/S/2024/215

Suggest a correction on GitHub