Lazarus Group delivered

RATANKBA and other malicious code to victims via a compromised legitimate website.(Citation: RATANKBA)(Citation: Google TAG Lazarus Jan 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|A

Lazarus Group malware sample encodes data with base64.(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.009|Shortcut Modification|

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1055.001|Dynamic-link Library Injection|A

Lazarus Group malware sample performs reflective DLL injection.(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Lazarus Group has conducted C2 over HTTP and HTTPS.(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)(Citation: ESET Twitter Ida Pro Nov 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|