Kaspersky Securelist
Kaspersky IT threat report for Q1 2022 (DPRK-related paragraph 3) · 2022-05-27
The threat actor configured this infrastructure with servers set up as multiple stages. The first stage is the source for the backdoor, while the purpose of the second stage servers is to communicate with the implants. This represents a common scheme for Lazarus infrastructure.