North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign · 2022-01
North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign
https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
31st January– Threat Intelligence Report · 2022-01-31
North Korean APT group Lazarus is using the Windows Update client as a living-off-the-land tool, to run malicious code on Windows in an email phishing campaign masquerading as job offers.
Multiple Organizations · 28/01/2022
A new campaign by the Lazarus Group uses spear phishing attacks weaponized with malicious documents that use fake job opportunities masquerading as the global security and aerospace giant Lockheed Martin. [Date Occurred: 18/01/2022; Date Discovered: 18/01/2022]
Lazarus APT leverages Windows Update client, GitHub in latest campaign (Lockheed Martin job lure) · 2022-01-21T20:05:00+00:00
The Malwarebytes Threat Intelligence team is actively monitoring its activities and was able to spot a new campaign on Jan 18th 2022. ... In this campaign, Lazarus conducted spear phishing attacks weaponized with malicious documents that use their known job opportunities theme . We identified two decoy documents masquerading as American global security and aerospace giant Lockheed Martin.