Anti-Forensic Techniques Used By Lazarus Group · 2023-02-15
excerpt: Since approximately a year ago, the Lazarus group’s malware has been discovered in various Korean companies related to national defense, satellites, software, and media press. The AhnLab ASEC analysis team has been continuously tracking the Lazarus threat group’s activities and other related TTPs. Among the recent cases, this post aims to share the anti-forensic traces […] | attribution sentence: Since approximately a year ago, the Lazarus group’s malware has been discovered in various Korean companies related to national defense, satellites, software, and media press. | target sentence: Backdoors characteristically must persist for long periods of time on the target system without being detected, so the Lazarus group modifies the malware creation timestamp information to hide the backdoor.
라자루스 그룹이 사용한 안티 포렌식 기법 · 2023-02-15
excerpt: 약 1년 전부터 라자루스 공격 그룹의 악성코드가 국내의 방산, 인공위성, 소프트웨어, 언론사 등 다수의 업체들에서 발견되고 있어, 안랩 ASEC 분석팀은 라자루스 공격 그룹의 활동 및 관련 TTP’s를 지속적으로 추적하고 있다. 본 글에서는 최근 사례 중 라자루스 그룹이 침해한 시스템에서 확인된 안티 포렌식 흔적과 내용을 공유하고자 한다. 개요 안티 포렌식 정의 안티 포렌식이란 범죄 현장에서 증거의 […] | attribution sentence: 약 1년 전부터 라자루스 공격 그룹의 악성코드가 국내의 방산, 인공위성, 소프트웨어, 언론사 등 다수의 업체들에서 발견되고 있어, 안랩 ASEC 분석팀은 라자루스 공격 그룹의 활동 및 관련 TTP’s를 지속적으로 추적하고 있다.
Anti-Forensic Techniques Used By Lazarus Group · February
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 5 of 75, PDF p. 319). DPRK cyber actor: Lazarus Group; Report Name: Anti-Forensic Techniques Used By Lazarus Group; Case Summary: The Lazarus Group carried out anti-forensics to conceal their malicious activities. They transmitted a configuration file with C2 information and a PE file that communicates with the C2 server in encrypted forms to evade detection by security products. The encrypted files operate after being decrypted onto the memory by the loader file. They then receive additional files from theC2 and perform malicious actions.; Publication Month: February
Anti-Forensic Techniques Used By Lazarus Group · 23 February 2023
Annex 64 (Links to Ahnlab Security Emergency Response Center (ASEC) reports in 2023 (as of July 2023); Source: ASEC), listed under “Lazarus Group”: “Anti-Forensic Techniques Used By Lazarus Group” (23 February 2023)