Multiple organizations in the cryptocurrency space · 12/04/2023
Researchers from Kaspersky discover a new cluster of activity, dubbed DeathNote, part of the Operation DreamJob or NukeSped, carried out by the North Korean threat actor Lazarus Group. [Date Occurred: Since 2019; Date Discovered: -]
Following the Lazarus group by tracking DeathNote campaign | Securelist · April
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 16 of 75, PDF p. 321). DPRK cyber actor: Lazarus Group; Report Name: Following the Lazarus group by tracking DeathNote campaign | Securelist; Case Summary: In an October 2019 -March 2022 campaign, dubbed ‘DeathNote’, the Lazarus Group used social engineering lures mimicking cryptocurrency businesses and defense contractors to trick victims into interacting with macro-laced Word attachments and PDF files. When the victims opened the file, the macro installed an obfuscated VBScript that extracted payloads in the form of harmful UltraVNCwith backdoor capabilities that evade detection and establish a connection to a separate C2 server.; Publication Month: April
Following the Lazarus group by tracking DeathNote campaign · 2023-04-12T08:00:00
The Lazarus group is a high-profile Korean-speaking threat actor with multiple sub-campaigns. In this blog, we’ll focus on an active cluster that we dubbed DeathNote.