16th December – Threat Intelligence Bulletin · 2019-12-16
A new variant of Trickbot has been analyzed by researchers, targeting high-value targets for financial motives. The variant, named Anchor, was deployed in conjunction of a PowerShell-based malware attributed to the North-Korean Lazarus Group, which is known to pursue targets of financial sectors. The research suggests a possible collaboration between Lazarus and Trickbot operators.
Lazarus use of Trickbot “Anchor Project” to deploy PowerRatankba · 2019
Para 182: “In a new development, in 2019, several security firms reported links between the Democratic People’s Republic of Korea and an Eastern European cybercrime group known as the Trickbot Group. ... According to cybersecurity research firms, the Lazarus Group used Anchor Project tools to deploy malware. Specifically, researchers discovered PowerRatankba, a suite of malware tools developed by Lazarus that was delivered to victims via the Anchor Project. This attack is significant because it represents the first known instance where Democratic People’s Republic of Korea-linked cybergroups have partnered with non-state actors.”
5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus | SentinelOne · 2019-12-11T17:00:24.000Z
SentinelLabs finds that TrickBot malware now counts North Korean-backed Lazarus/Hidden Cobra group among its customers, uniting high-tech crimeware with APT