The Trap of Troubleshooting: Analysis of Lazarus (APT-Q-1)'s Recent Attacks Using ClickFix

QiAnXin Threat Intelligence Center (RedDrip)

Lazarus is an APT group suspected to have a Northeast Asian background, and its Qi'anxin internal tracking number is APT-Q-1. The group gained widespread attention with its 2014 attack on Sony Pictures, with its activity dating back to 2007. Initially, Lazarus primarily targeted government agencies to steal sensitive intelligence, but since 2014, it has also begun attacking global financial institutions, cryptocurrency exchanges, and other targets, stealing financial assets from victims. Lazarus has repeatedly used fake social media accounts, disguised as job opportunities, to launch phishing attacks targeting individuals in specific industries.