APT trends report Q3 2022 (DPRK-related paragraph 3)

Kaspersky Securelist

We observed a rise in the use of the DeathNote cluster recently. In March, we saw Lazarus use it against victims in South Korea. The actor possibly used a strategic web compromise, employing an infection chain similar to that which we previously reported, abusing an endpoint security program. However, we discovered that the malware and infection schemes have been updated. The attacker used a multi-stage infection, starting with the Racket Downloader. Through Racket Downloader, the operator deployed additional malware for further post-exploitation activity. In this phase, the actor used malware that we hadn’t seen before, with minimal functionality to execute commands from the C2 server. Using this implanted backdoor, the operator conducted many hands-on keyboard activities. They lurked in this victim’s environment for a month and executed various commands to collect basic system information. Also, we observed how they attempted to find valuable hosts with high privileges, such as file servers or Active Directory servers. Lazarus Group delivered additional malware such as a keylogger and password-dumping tool to collect more information. Moreover, as a result of working closely with KrCERT, we had a chance to look into the adversary’s C2 scripts. They employed a similar C2 structure as before, compromising a web server and configuring a multi-stage C2 server, with the first stage server acting as a proxy server and the second stage server used for controlling victims.