Campaign targeting nuclear engineers and the defence industry via fake job interviews on Telegram and WhatsApp · October 2023 (report)
Para 132: “In a report issued in October 2023, an ongoing Lazarus Group campaign was identified that targeted nuclear engineers and the defence industry, including manufacturers of radar systems, uncrewed aerial vehicles, military vehicles, ships, weaponry and maritime companies. The Lazarus Group reportedly obtained systems access by manipulating job seekers on social media, including Telegram and WhatsApp, into opening malicious apps for fake job interviews.”
APT trends report Q3 2023 (DPRK-related paragraph 1) · 2023-10-17
We discovered an ongoing Lazarus campaign targeting the defense industry and nuclear engineers. Lazarus uses Trojanized apps, especially backdoored VNC apps, to access enterprise systems. The threat actor tricks job seekers on social media into opening malicious apps for fake job interviews. To avoid detection by behavior-based security solutions, this backdoored application operates discreetly, only activating when the user selects a server from the drop-down menu of the Trojanized VNC client. The application launches additional payloads into memory and retrieves further malicious code. Through our telemetry, we have observed the installation of an additional payload on the victim’s system. Once the compromised VNC client is executed by the victim, it triggers the creation of further malware known as “LPEClient”, which has been previously used by the Lazarus group on multiple occasions. It also employs sophisticated C2 communication methods and disables behavior monitoring by unhooking user-mode syscalls. We also saw the use of an updated version of COPPERHEDGE as an additional backdoor, with a complex infection chain. In addition, we observed the presence of a malware variant specifically designed to transfer targeted files to a remote server. The purpose of this particular malware is to exfiltrate specific files chosen by the Lazarus group and send them to their designated remote server. Through our telemetry, we have confirmed numerous instances of compromised companies. The majority of these affected companies are directly involved in defense manufacturing, including radar systems, unmanned aerial vehicles (UAVs), military vehicles, ships, weaponry and maritime companies. Furthermore, our observations led us to identify the username associated with the initial infection. Subsequently, through conversations with the victim, we verified that this indeed corresponded to the real name of the victim. This individual is a nuclear engineer based in Hungary who received the malicious file after being in contact with a suspicious account via Telegram and WhatsApp.