Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution

ThaiCERT Threat Group Cards

Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution https://asec.ahnlab.com/en/54195/

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: As covered before here on the ASEC Blog, the Lazarus threat group exploits the vulnerabilities of INISAFE CrossWeb EX and MagicLine4NX in their attacks.  New Malware of Lazarus Threat Actor Group Exploiting INITECH Process (Apr 26, 2022) A Case of Malware Infection by the Lazarus Attack Group Disabling Anti-Malware Programs With the BYOVD Technique (Oct […] | attribution sentence: As covered before here on the ASEC Blog, the Lazarus threat group exploits the vulnerabilities of INISAFE CrossWeb EX and MagicLine4NX in their attacks. | target sentence: New Malware of Lazarus Threat Actor Group Exploiting INITECH Process (Apr 26, 2022) A Case of Malware Infection by the Lazarus Attack Group Disabling Anti-Malware Programs With the BYOVD Technique (Oct 31, 2022) While monitoring the activities of the Lazarus threat group, AhnLab Security Emergency r

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: Lazarus 공격 그룹은 이전 ASEC 블로그에서도 소개했던 바와 같이 INISAFE CrossWeb EX와 MagicLine4NX의 취약점을 공격에 활용하고 있다.   INITECH 프로세스를 악용하는 라자루스 공격 그룹의 신종 악성코드 (2022.04.18) BYOVD 기법으로 백신 프로그램을 무력화하는 라자루스 공격 그룹의 악성코드 감염 사례 (2022.10.24) ASEC(AhnLab Security Emergency response Center)에서는 Lazarus 공격 그룹의 활동을 모니터링 하던 중, 기존에 공격에 악용되던 INISAFE […] | attribution sentence: Lazarus 공격 그룹은 이전 ASEC 블로그에서도 소개했던 바와 같이 INISAFE CrossWeb EX와 MagicLine4NX의 취약점을 공격에 활용하고 있다.

Since Lazarus actively seeks out and exploits new vulnerabilities in software used in Korea, it is highly recommended that businesses utilizing these software solutions promptly update to the latest versions.