APT trends report Q3 2022 (DPRK-related paragraph 4)

Kaspersky Securelist

We uncovered an ongoing campaign targeting defense contractors in South Africa and Brazil. The threat actor behind the attacks contacted potential victims via social media or email and sent the initial malware through Skype. The malware is a Trojanized PDF application that initiates a multi-stage infection chain, loading additional payloads that contain C2 communication capability via the DLL sideloading technique. Additionally, the threat actor deployed additional malware to the initial host to pivot and perform lateral movement. In this process, the operator took advantage of a relatively new DLL sideloading technique named ServiceMove. This technique was introduced by a red team researcher and abused the Windows Perception Simulation Service to load arbitrary DLL files for malicious purposes. This notorious threat actor operates several clusters and attacks various targets based on its intentions. In one of the victims, we observed a similar initial infection vector. However, the actor used different malware. Lazarus Group is equipped with various tools and employs them with various infection chains. While examining all the samples in this case, we observed different clusters: ThreatNeedle, Bookcode, and DeathNote.