APT trends report Q2 2023 (DPRK-related paragraph 1)

Kaspersky Securelist

In early September 2022, our team discovered several malware detections from the MATA cluster, previously attributed to the Lazarus group, targeting defense contractors in Eastern Europe. This campaign remained active until March 2023. Expanding the scope of our research, we investigated and discovered additional new, active campaigns with full infection chains, including an implant designed to work in air-gapped networks via USB sticks, as well as a Linux MATA backdoor. The new, updated MATA malware was distributed using spear-phishing techniques, with the attackers deploying their malware in multiple stages using validators. The threat actor also abused various security and anti-malware solutions used by the victims. The new MATA orchestrator introduced several modifications to its encryption, configuration and communication protocols and appears to have been rewritten from scratch. The next generation of MATA includes new functionality to circumvent network restrictions, allowing the actor to build complex proxy chains within the victims’ network, and to create a ‘stack’ of various communication protocols to be used for C2 communications.