Lazarus Group has used the Windows API

Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and

Process Injection.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1021.004|SSH|

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.006|Web Services|

Lazarus Group has hosted malicious downloads on Github.(Citation: CISA AppleJeus Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.004|Digital Certificates|

Lazarus Group has obtained SSL certificates for their C2 domains.(Citation: CISA AppleJeus Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1587.001|Malware|

Lazarus Group has developed custom malware for use in their operations.(Citation: CISA AppleJeus Feb 2021)(Citation: Google TAG Lazarus Jan 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.(Citation: CISA AppleJeus Feb 2021)(Citation: Google TAG Lazarus Jan 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|Some