Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.(Citation: US-CERT SHARPKNOT June 2018)(Citation: Novetta Blockbuster)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1489|Service Stop|

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.(Citation: Novetta Blockbuster Destructive Malware)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.(Citation: McAfee Bankshot)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.(Citation: McAfee Bankshot)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.(Citation: McAfee Bankshot)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Network|T1124|System Time Discovery|A Destover-like implant used by

Lazarus Group can obtain the current system time and send it to the C2 server.(Citation: McAfee GhostSecret)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Lazarus Group delivered