Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via

KernelCallbackTable hijacking.

Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|

Lazarus Group has used multi-stage malware components that inject later stages into separate processes.(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1218|System Binary Proxy Execution|

Lazarus Group lnk files used for persistence have abused the Windows Update Client (

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.005|Mshta|

Lazarus Group has used

Lazarus Group persistence mechanisms have used

Lazarus Group has renamed system utilities such as

Lazarus Group has replaced

Lazarus Group has abused the

Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.(Citation: Kaspersky ThreatNeedle Feb 2021) |
|mitre-attack|enterprise-attack,ics-attack|PRE|T1585.001|Social Media Accounts|