AhnLab ASEC blog (asec.ahnlab.com)
Analysis of Lazarus Group’s Attack on Windows Web Servers · 2025-03-05
excerpt: AhnLab SEcurity intelligence Center (ASEC) has identified attack cases of the Lazarus group breaching a normal server and using it as a C2. Attacks that install a web shell and C2 script on South Korean web servers continue to occur. Additionally, there are cases where LazarLoader malware and privilege escalation tools are identified. 1. […] | attribution sentence: AhnLab SEcurity intelligence Center (ASEC) has identified attack cases of the Lazarus group breaching a normal server and using it as a C2. | target sentence: Note that the targeted web server was an IIS server, so a web shell in ASP format and a C2 script were used.