Article Content by Lenart Bermejo and Joelson Soares  The cybercriminal group Lazarus, and particularly its subgroup Bluenoroff, has a history of attacking financial organizations in Asia and Latin America There seems to be a resurgence of activity from the group, and recent events show how their tools and techniques have evolved Just last week they were found stealing millions from ATMs across Asia and Africa We also recently discovered that they successfully planted their backdoor (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) into several machines of financial institutions across Latin America We determined that these backdoors were installed on the targets’ machines on September 19 2018, based mainly on the service creation time of the loader component We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack, analyzed by BAE Systems, against targets in Asia The use of FileTokenBroker.dll was a key part of the group’s attack in 2017, and they seem to have used the same modularized backdoor in the recent incident as well However, they still have the same capabilities and are essentially the same file The connection is necessary for conducting activities; and based on the backdoor’s functions, these actions could be quite damaging to targets This complex setup makes it harder to detect and remove all the backdoors, and is more effective at hiding any activities The complexity and the capabilities of these backdoors present a tough problem for the targeted organizations It is a sophisticated attack that needs equally sophisticated security solutions Trend Micro Solutions The Lazarus group is an experienced organization, methodically evolving their tools and experimenting with strategies to get past an organization’s defenses These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization In addition, educating employees and other key people in an organization on social engineering techniques can allow them to identify what to look out for when it comes to malicious attacks Other mitigation strategies include a multilayered approach to securing the organization’s perimeter, which includes hardening the endpoints and employing application control to help prevent malicious applications and processes from being executed Trend Micro endpoint solutions such as Trend Micro Smart Protection Suites and Worry-Free Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs Trend Micro Deep Discovery has an email inspection layer that can protect enterprises by detecting malicious attachments and URLs that could lead to malicious downloads Trend Micro XGen security provides a cross-generational blend of threat defense techniques to protect systems from all types of threats It features high-fidelity machine learning on gateways and endpoints, and protects physical, virtual, and cloud workloads With capabilities like web/URL filtering, behavioral analysis, and custom sandboxing, XGen security protects against today’s threats that bypass traditional controls; exploit known, unknown, or undisclosed vulnerabilities; either steal or encrypt personally identifiable data; or conduct malicious cryptocurrency mining Indicators of Compromise Command and Control Servers 107[.]172[.]195[.]20 192[.]3[.]12[.]154 46[.]21[.]147[.]161 The post Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America appeared first on 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content by Lenart Bermejo and Joelson Soares  The cybercriminal group Lazarus, and particularly its subgroup Bluenoroff, has a history of attacking financial organizations in Asia and Latin America There seems to be a resurgence of activity from the group, and recent events show how their tools and techniques have evolved Just last week they were found stealing millions from ATMs across Asia and Africa We also recently discovered that they successfully planted their backdoor (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) into several machines of financial institutions across Latin America We determined that these backdoors were installed on the targets’ machines on September 19 2018, based mainly on the service creation time of the loader component We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack, analyzed by BAE Systems, against targets in Asia The use of FileTokenBroker.dll was a key part of the group’s attack in 2017, and they seem to have used the same modularized backdoor in the recent incident as well However, they still have the same capabilities and are essentially the same file The connection is necessary for conducting activities; and based on the backdoor’s functions, these actions could be quite damaging to targets This complex setup makes it harder to detect and remove all the backdoors, and is more effective at hiding any activities The complexity and the capabilities of these backdoors present a tough problem for the targeted organizations It is a sophisticated attack that needs equally sophisticated security solutions Trend Micro Solutions The Lazarus group is an experienced organization, methodically evolving their tools and experimenting with strategies to get past an organization’s defenses These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization In addition, educating employees and other key people in an organization on social engineering techniques can allow them to identify what to look out for when it comes to malicious attacks Other mitigation strategies include a multilayered approach to securing the organization’s perimeter, which includes hardening the endpoints and employing application control to help prevent malicious applications and processes from being executed Trend Micro endpoint solutions such as Trend Micro Smart Protection Suites and Worry-Free Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs Trend Micro Deep Discovery has an email inspection layer that can protect enterprises by detecting malicious attachments and URLs that could lead to malicious downloads Trend Micro XGen security provides a cross-generational blend of threat defense techniques to protect systems from all types of threats It features high-fidelity machine learning on gateways and endpoints, and protects physical, virtual, and cloud workloads With capabilities like web/URL filtering, behavioral analysis, and custom sandboxing, XGen security protects against today’s threats that bypass traditional controls; exploit known, unknown, or undisclosed vulnerabilities; either steal or encrypt personally identifiable data; or conduct malicious cryptocurrency mining Indicators of Compromise Command and Control Servers 107[.]172[.]195[.]20 192[.]3[.]12[.]154 46[.]21[.]147[.]161 The post Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America appeared first on  ### Response: .