Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560.003|Archive via Custom Method|A

Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1491.001|Internal Defacement|

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a

Disk Structure Wipe.(Citation: Novetta Blockbuster Destructive Malware)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|Various

Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using

netsh. (Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster Tools)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1001.003|Protocol Impersonation|

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|