APT trends report Q3 2021 (DPRK-related paragraph 2)

Kaspersky Securelist

We have also discovered Lazarus group campaigns using an updated DeathNote cluster. The first involved an attack on a think tank in South Korea in June. The second was an attack on an IT asset monitoring solution vendor in May. Our investigation revealed indications that point to Lazarus building supply-chain attack capabilities. In one case, we found that the infection chain stemmed from legitimate South Korean security software executing a malicious payload; and in the second case, the target was a company developing asset monitoring solutions in Latvia, an atypical victim for Lazarus. The DeathNote malware cluster consisted of a slightly updated variant of BLINDINGCAN, malware previously reported by the US CISA (Cybersecurity & Infrastructure Security Agency). BLINDINGCAN was also used to deliver a new variant of COPPERHEDGE, also reported in a CISA article. We had previously reported our initial finding of COPPERHEDGE in January 2020. As part of the infection chain, Lazarus used a downloader named Racket that they signed using a stolen certificate. As a result of taking over the attacker’s infrastructure with a local CERT, we had a chance to look into several C2 scripts associated with the DeathNote cluster. The actor compromised vulnerable web servers and uploaded several scripts to filter and control the malicious implants on successfully breached victim machines.