23rd December – Threat Intelligence Report · 2024-12-23
Researchers report on evolution of tools, techniques and procedures (TTPs) of North Korean hacking group Lazarus. In their latest attacks targeting the nuclear sector, the group introduced CookiePlus, a novel framework malware capable of downloading DLL and shellcode.
Unnamed nuclear-related organization · 19/12/2024
Researchers at Kaspersky reveal that the Lazarus Group, the threat actor linked to the Democratic People's Republic of Korea (DPRK), has been observed leveraging a "complex infection chain" targeting at least two employees belonging to an unnamed nuclear-related organization. The attacks, part of Operation Dream Job, culminated in the deployment of a new modular backdoor referred to as CookiePlus, [Date Occurred: During October 2024; Date Discovered: During October 2024]
“북한 라자루스 그룹, 쿠키플러스 악성코드로 핵 관련 기관 직원 타깃 공격” · 2024-12-20
attribution sentence(s): 북한 연계 해킹조직 라자루스 그룹(Lazarus Group)이 핵 관련 조직의 직원들을 대상으로 한 정교한 공격 캠페인을 진행한 사실이 카스퍼스키(Kaspersky)의 글로벌 리서치 및 분석팀(GReAT) 보고서를 통해 밝혀졌다. | 산업에 대한 라자루스의 집요한 침투 시도를 보여준다. | 이후 라자루스는 유럽, 라틴아메리카, 한국, 아프리카 등 다양한 지역의 기업으로 공격 대상을 확대했다.
Lazarus group evolves its infection chain with old and new malware · 2024-12-19T10:00:55
Lazarus targets employees of a nuclear-related organization with a bunch of malware, such as MISTPEN, LPEClient, RollMid, CookieTime and a new modular backdoor CookiePlus.