APT trends report Q3 2021 (DPRK-related paragraph 1)

Kaspersky Securelist

In June, we observed the Lazarus group attacking the defense industry using the MATA malware framework. Historically, Lazarus used MATA to attack various industries for cybercrime-like intentions: stealing customer databases and spreading ransomware. However, here we saw Lazarus using MATA for cyber-espionage purposes. The actor delivered a Trojanized version of an application known to be used by their victim of choice, representing a known characteristic of Lazarus. Executing this application starts a multi-staged infection chain beginning with a downloader. This downloader fetches additional malware from compromised C2 servers. We were able to acquire several MATA components, including plugins. The MATA malware discovered in this campaign has evolved compared to previous versions and uses a legitimate, stolen certificate to sign some of its components. Through this research, we discovered a stronger connection between MATA and the Lazarus group, including the fact that the downloader malware fetching MATA malware showed ties to TangoDaiwbo, which we had previously attributed to the Lazarus group.