APT trends report Q2 2023 (DPRK-related paragraph 2)

Kaspersky Securelist

We have been tracking an unknown malware cluster, dubbed “ScoutEngine”. Initially, we found no similarities with known malware or threat actors. However, upon closer inspection of the entire malware, we discovered that this malware has been in continuous development since 2020. ScoutEngine has several numbered versions from 2.1 to 2.3. Each version has a different infection scheme, and the malware author has updated the method for retrieving the next stage payload and configuration data, decryption key, and C2 communication formats as the versions have evolved. ScoutEngine’s objective is to fetch additional payloads based on the attacker’s commands and execute them in memory. Unfortunately, we are currently unable to determine the final payload. Ultimately, we were able to confidently conclude that the Lazarus group is responsible for the ScoutEngine cluster. Its components and configurations closely resemble those of Lazarus malware: in particular, ScoutEngine employs an unusual method, previously observed in the CookieTime malware, to generate a registry path and acquire configuration data.