New Malware of Lazarus Threat Actor Group Exploiting INITECH Process · 2022-04-18
excerpt: The AhnLab ASEC analysis team has discovered that there are 47 companies and institutions—including defense companies—infected with the malware distributed by the Lazarus group in the first quarter of 2022. Considering the severity of the situation, the team has been monitoring the infection cases. In systems of the organizations infected with the malware, it was […] | attribution sentence: The AhnLab ASEC analysis team has discovered that there are 47 companies and institutions—including defense companies—infected with the malware distributed by the Lazarus group in the first quarter of 2022. | target sentence: The post titled ‘Lazarus Targets Chemical Sector’ uploaded on April 15th reveals that the Lazarus group attacked the chemical sector.
INITECH 프로세스에 인젝션돼 동작하는 라자루스 공격 그룹의 신종 악성코드 · 2022-04-18
excerpt: 안랩 ASEC 분석팀은 2022년 1분기에 방산 업체를 포함한 약 47개의 기업 및 기관이 라자루스 그룹에서 유포 중인 악성코드에 감염되고 있는 정황을 파악하고, 이를 심각하게 판단해 모니터링 하고 있다. 피해 업체들에서는 INITECH사 프로세스(inisafecrosswebexsvc.exe)에 의해 악성 행위가 발생되는 것이 확인됐다. 피해 시스템에서 inisafecrosswebexsvc.exe에 대해 다음과 같은 내용을 우선 확인했다. inisafecrosswebexsvc.exe 파일은 INITECH사의 보안 프로그램인 INISAFE CrossWeb EX […] | attribution sentence: 안랩 ASEC 분석팀은 2022년 1분기에 방산 업체를 포함한 약 47개의 기업 및 기관이 라자루스 그룹에서 유포 중인 악성코드에 감염되고 있는 정황을 파악하고, 이를 심각하게 판단해 모니터링 하고 있다. | target sentence: 지난 4월 15일에 게시된 “Lazarus Targets Chemical Sector”라는 제목의 블로그에는 라자루스 공격 그룹이 화학 섹터를 공격한 내용을 다루고 있다.
Exploiting INITECH Process · April
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel (table row 9 of 37). RGB Unit: Lazarus Group; Case Name: Exploiting INITECH Process; SPH √; VAS: (blank); Publicized Month: April. (Note: RGB Reconnaissance General Bureau, SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures.)
47 companies and institutions, including defence companies, infected via INITECH process · first quarter of 2022
Para 124: “In another case, 47 companies and institutions – including defence companies – were discovered to be infected with new malware distributed by the Lazarus Group in the first quarter of 2022. These malicious behaviours, such as execution of arbitrary commands from an outside entity within the systems of these organizations, are said to have stemmed from the INITECH (inisafecrosswebexsvc.exe) process being infected by a malware type called “SCSKAppLink.dll”.”
New Malware of Lazarus Threat Actor Group Exploiting INITECH Process - ASEC BLOG (ahnlab.com) · 26 April 2022
Annex 53.2 (Links to reports from Ahnlabs ASEC in 2022; Source: Ahnlabs ASEC, annotated by the Panel), listed under “Lazarus Group”: “New Malware of Lazarus Threat Actor Group Exploiting INITECH Process - ASEC BLOG (ahnlab.com)” (26 April 2022)