Kaspersky Securelist
Kaspersky IT threat report for Q1 2022 (DPRK-related paragraph 2) · 2022-05-27
We attribute the attacks, with high confidence, to the Lazarus group. We discovered numerous overlaps with other tools used by the same threat actor. The malware operator exclusively used compromised web servers located in South Korea for this attack. To take over the servers, we worked closely with a local CERT ; as a result of this effort, we had the opportunity to investigate a Lazarus group C2 server.