Lazarus Group - G0032

Created: 2017-05-31T21:32:03.807Z

Modified: 2023-03-30T19:01:41.451Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet,Dragos  Threat  Intelligence

Aliases

Lazarus Group,Labyrinth Chollima,HIDDEN COBRA,Guardians of Peace,ZINC,NICKEL ACADEMY

Description

Lazarus Group is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Korean Cyber Groups September 2019) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novetta Blockbuster)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups, such as Andariel, APT37, APT38, and Kimsuky.

Techniques Used

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Lazarus Group has used a scheduled task named

Lazarus Group has restored malicious

KernelCallbackTable code to its original state after the process execution flow has been hijacked.(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Linux,Windows|T1620|Reflective Code Loading|

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via

KernelCallbackTable hijacking.