Kaspersky Securelist
IT threat evolution Q1 2019 (DPRK-related paragraph 1) · 2019-05-23
The Lazarus APT group is well-known for targeting financial organizations . In the middle of 2018, we published our report on ‘ Operation AppleJeus ‘, highlighting the threat actor’s focus on crypto-currency exchanges, using a fake company with a backdoored product aimed at crypto-currency businesses. One of the key findings was the group’s new ability to target Mac OS. Since then, Lazarus has expanded its operations for this platform. Further tracking of the group’s activities enabled us to discover a new operation, active since at least November 2018, which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .