Lazarus Group has digitally signed malware and utilities to evade detection.(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1557.001|LLMNR/NBT-NS Poisoning and SMB Relay|

Lazarus Group executed

Responder using the command

Lazarus Group has sent malicious links to victims via email.(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Lazarus Group has used

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

Lazarus Group has used

Lazarus Group has used administrator credentials to gain access to restricted network segments.(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

Lazarus Group has used PowerShell to execute commands and malicious code.(Citation: Google TAG Lazarus Jan 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1106|Native API|

Lazarus Group has used the Windows API