Lazarus

Lazarus Group is a North Korean threat actor. The provided content associates it with both espionage and financially motivated activity, including targeting finance, cryptocurrency, and defense organizations. Known aliases in the provided content include APT-C-26, BadClone, Contagious Interview, Coral Sleet, DeceptiveDevelopment, DEV#POPPER, Diamond Sleet, Famous Chollima, Genie Spider, Gwisin Gang, Labyrinth Chollima, Nickel Tapestry, Pukchong, PurpleBravo, Selective Pisces, Storm-1877, TA404, TAG-121, TempHermit, Tenacious Pungsan, UNC2970, UNC5267, Void Dokkaebi, and WaterPlum. The content links Lazarus Group to campaigns including Operation Dream Job, Operation AppleJeus, and Contagious Interview. In Operation Dream Job and related recruiter-themed activity, the group impersonated HR hiring personnel through LinkedIn, social media, job board notifications, and fake interviews to entice victims to download malware, including malicious documents, disguised applications, or malicious scripts from code repositories. The content also notes overlap between Contagious Interview and the North Korean-linked cluster PurpleBravo/TAG-120, which primarily targeted software developers in the cryptocurrency industry. Unit 42 attribution in the provided content links related payloads to Selective Pisces, and Palo Alto Unit 42 tracks DEV#POPPER with malware families BeaverTail and InvisibleFerret. The provided content describes Lazarus Group tradecraft including use of spearphishing emails with malicious Microsoft Word attachments; use of compromised servers to host malware during Operation Dream Job; command and control over HTTP and HTTPS; shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime; creation of new Windows services for persistence; file and directory discovery across drives and identification of target files by extension; hiding files by setting System and Hidden attributes or using dot-prefixed filenames on macOS; enumeration of logged-on users; collection of network interface configuration including IP address, gateways, subnet mask, DHCP information, and WINS availability; and Active Directory account discovery, including querying compromised AD servers for employee and administrator account lists during Operation Dream Job. The content also references Lazarus Group malware families and operations including WannaCry, Hermes, and BLINDINGCAN, and notes that the group has been associated with more than 80 ATT&CK techniques in the referenced profile.