Operation “Dream Magic”

ThaiCERT Threat Group Cards

Operation “Dream Magic” https://asec.ahnlab.com/en/57736/

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: The Lazarus group is a hacking group that is known to be state-sponsored and is actively conducting hacking activities worldwide for financial gain, data theft, and other purposes. A simplified overview of the Lazarus group’s watering hole attack that abused the INISAFE vulnerability is as follows: a malicious link was inserted within a specific article […] | attribution sentence: The Lazarus group is a hacking group that is known to be state-sponsored and is actively conducting hacking activities worldwide for financial gain, data theft, and other purposes. | target sentence: Consequently, companies and institutions that clicked on this article were targeted for hacking.

AhnLab ASEC blog (asec.ahnlab.com)

excerpt: Lazarus 조직은 국가가 배후인 것으로 알려진 해킹 조직으로 금전적인 이득, 자료 탈취 등의 목적으로 전세계를 대상으로 꾸준히 해킹하고 있습니다. Lazarus 조직의 이니세이프 취약점을 악용한 워터링 홀을 간단하게 정리하면 언론사의 특정 기사에 악성 링크 삽입, 해당 기사를 클릭하는 기업, 기관이 해킹 대상, 국내 취약한 홈페이지를 C2 로 악용 그리고 제한된 범위의 해킹을 위해서 IP 필터링 등을 […] | attribution sentence: Lazarus 조직은 국가가 배후인 것으로 알려진 해킹 조직으로 금전적인 이득, 자료 탈취 등의 목적으로 전세계를 대상으로 꾸준히 해킹하고 있습니다. | target sentence: Lazarus 조직은 국가가 배후인 것으로 알려진 해킹 조직으로 금전적인 이득, 자료 탈취 등의 목적으로 전세계를 대상으로 꾸준히 해킹하고 있습니다.

UN Panel of Experts S/2024/215

Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 44 of 75, PDF p. 327). DPRK cyber actor: Lazarus Group; Report Name: Lazarus Group's Operation Dream Magic -ASEC BLOG (ahnlab.com) 국정원 “北 보안인증 소프트웨어 ‘매직라인 ’ 취약점 악용 해킹 ” 재경고 ｜ 동아일보 (donga.com); Case Summary: The Lazarus Group exploited vulnerable Republic of Korea websites with C2 to facilitate their attacks and implemented IP filtering for selective targeting, using the MagicLine program vulnerability. The National Intelligence Service of the Republic of Korea confirmed in November 2023 that the Lazarus Group attacked approximately 50 public institutions, media, defense companies, and IT companies in the Republic of Korea in June 2023.; Publication Month: October/ November

The hackers exploited vulnerable Korean websites with C2 to facilitate their attacks and implemented IP filtering for selective targeting.