Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide · 01.02.2022
According to a report by Cisco Talos, the North Korean state-sponsored APT Lazarus Group targeted organizations, particularly energy providers, from around the world, primarily in Canada, the U.S. and Japan, in a new campaign conducted between February and July 2022. For this, vulnerabilities in VMWare Horizon were exploited to gain long-term access to networks and then exfiltrate data.
Sources cited by EuRepoC (8)
Show 3 more
Lazarus and the tale of three RATs · 2022-02
Lazarus and the tale of three RATs
https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Lazarus and the tale of three RATs · 2022-07
Lazarus and the tale of three RATs
https://blog.talosintelligence.com/lazarus-three-rats/
Lazarus and the tale of three RATs · 2022-09-08T12:01:00.000Z
Cisco Talos observed North Korean state-sponsored APT Lazarus Group conducting malicious activity between February and July 2022. Lazarus has been previously attributed to the North Korean government by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The entry vectors involve the successful exploitation of vulnerabilities in VMWare products to establish initial footholds into enterprise networks, followed by the deployment of the group's custom malware implants,VSingle and YamaBot.
23rd May – Threat Intelligence Report · 2022-05-23
North Korean APT group Lazarus has been targeting VMware Horizon servers leveraging the critical remote code execution flaw Log4J (CVE-2021-44228) since at least April 2022. Threat actors proceeded by executing a PowerShell command that would lead to the installation of the NukeSped backdoor.
12th September – Threat Intelligence Report · 2022-09-12
North Korean APT group Lazarus (aka APT28) was found to be targeting energy providers across the globe, including in the US, Canada and Japan, in an espionage campaign exploiting the log4shell vulnerability on VMware Horizon as initial access.
Energy providers in the United States, Canada, and Japan. · 08/09/2022
Researchers from Cisco Talos discover a new campaign by the North Korean APT group 'Lazarus', exploiting VMWare Horizon servers vulnerabilities (Log4j) to access the corporate networks of energy providers in the United States, Canada, and Japan, via the custom malware families VSingle', 'YamaBot' and a previously unknown remote access trojan (RAT) named 'MagicRAT'. [Date Occurred: Between February and July 2022; Date Discovered: -]
Energy providers targeted through Log4j on VMware Horizon servers (VSingle, YamaBot, MagicRAT) · Between February and July 2022
Para 143: “Between February and July 2022 the Lazarus Group reportedly targeted energy providers in multiple Member States using a vulnerability in Log4j (also known as Log4Shell), according to several cybersecurity companies, to compromise Internet-exposed VMware Horizon servers. These eventually established an initial foothold in victims’ networks once malware known as “VSingle” and “YamaBot” was deployed ... Another remote access trojan named “MagicRAT” was also observed ... The main goal of the attacks was reportedly to establish long-term access to victims’ networks that “aligns with historical Lazarus intrusions targeting critical infrastructure and energy companies … to siphon off proprietary intellectual property”.”