Loading malware…
SecurityPDF is a trojanized Windows PDF viewer used by the Lazarus Group in its Operation Dream Job intrusion campaigns targeting defense-sector organizations, particularly aerospace and aviation entities in Europe and India. It is a modified PDF reader built from the MuPDF framework and distributed through recruiter-themed social engineering, impersonation websites, and search-engine optimization tied to fake job opportunities.
The malware is designed to appear as a legitimate document viewer while acting as a loader for a second-stage implant. When a victim opens an attacker-crafted PDF, SecurityPDF checks the document for a hidden marker and, if present, decrypts and executes an embedded payload. In observed attacks, this process launched the Troy backdoor directly in memory via a loader, reducing on-disk exposure. Troy is a modular Lazarus implant that supports remote command execution, reconnaissance, file operations, data exfiltration, process control, and in-memory DLL injection.
SecurityPDF functioned as part of a broader multi-stage intrusion chain associated with Lazarus job-lure operations. The campaign relied on fake recruiter personas and spoofed employer branding to entice targets to download the trojanized viewer and open malicious PDF content. The malware’s role was to provide initial execution of the embedded backdoor while preserving the appearance of a normal PDF-reading workflow, making it effective for targeted espionage operations against high-value organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...распространяли модифицированный PDF-ридер SecurityPDF, который предназначался для выполнения малвари, встроенной в заранее подготовленные хакерами PDF-файлы.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
В рамках этой кампании злоумышленники использовали поддельные сайты и SEO...
распространяли модифицированный PDF-ридер SecurityPDF, который предназначался для выполнения малвари, встроенной в заранее подготовленные хакерами PDF-файлы.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modified PDF reader used as part of Lazarus's Operation Dream Job campaign to execute malware embedded in attacker-prepared PDF files.
A trojanized PDF viewer used as a delivery mechanism to execute the Troy backdoor in memory when specially marked PDF files are opened.
A modified PDF viewer used as a trojanized delivery mechanism to execute malicious payloads embedded in attacker-crafted PDF files.
A trojanized PDF viewer based on MuPDF that checks opened PDFs for a marker, extracts an embedded payload, decrypts it with XOR, writes it to %TEMP%\new.exe, and launches it to load the Troy backdoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.