UN Panel of Experts S/2024/215
Lazarus Group Targeting Windows IIS Web Servers · May
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 19 of 75, PDF p. 322). DPRK cyber actor: Lazarus Group; Report Name: Lazarus Group Targeting Windows IIS Web Servers; Case Summary: The Lazarus Group attacked Windows IIS web servers through w3sp.exe. They placed a malicious DLL (msvcr100.dll) in the same folder as a normal application (Wordconv.exe) via the Windows IIS web server process, w3wp.exe. They then execute the normal application to initiate the execution of the malicious DLL.; Publication Month: May