Kaspersky Securelist
APT trends report Q2 2022 (DPRK-related paragraph 2) · 2022-07-28
Lazarus is currently one of the most active groups, with the defense industry and financial institutions being the primary targets. As a result of our continuous endeavors to track this actor’s activity, we have now discovered two additional operations from the group. DeathNote, which is under the Lazarus umbrella, is a sophisticated malware cluster actively used by this group, and most recently observed when the Lazarus group attacked a software vendor and think-tank. Since then, we have discovered several entities in South Korea that were infected with similar malware in February. However, the infection scheme was slightly updated in these cases as the actor added wAgent malware in its delivery procedure.