Lazarus campaigns and backdoors in 2022-2023

Wednesday 4 October 16:00 - 16:30, Green room

Peter Kálnai (ESET)

The Lazarus group is an infamous North Korea-aligned threat actor that has been active since at least 2009. There are various types of campaigns attributed to Lazarus, based on toolset similarities, shared infrastructure, telemetry, or the cui bono aspect, and we have been discovering these campaigns for years. In this presentation we will discuss their recent attacks, or their attempts, in the recent time frame of 2022 and 2023, several of which were never publicly disclosed. This includes decoy programming challenges against a Spanish aerospace company delivering a highly sophisticated RAT; Coinbase-themed decoys with both Windows and macOS payloads against individuals in South America; attempts to compromise banking entities in the United States and Tanzania via fake Signature Bank- and MUFG-themed job offers; an OpenSSL-based backdoor discovered in an agriculture-related entity from South Korea; a lure designed for Linux desktop users submitted to VirusTotal from Georgia and its relation to the recent 3CX supply chain attack, and more.

In our session we will study the relationship between recent Lazarus campaigns and their payloads delivered onto targeted systems. Usually there are many tools deployed in chains by these attackers: in the initial stages, various droppers, loaders and simpler downloaders are used to establish a stable foothold in the system, while in the final stages, fully featured RATs and complex downloaders are involved. We will focus on these final payloads, which are usually more sophisticated and harder to acquire. We dive deeper into the attackers’ custom implementation of the client-server model – the method of parsing server commands and the multi-step network authentication – as understanding and identification of these aspects may boost the confidence in the attribution verdict.

Finally, we will note the diverse geographical distribution of the group’s recent campaigns, and the fact that Lazarus operators have prepared their native payloads to cover all the major platforms: Windows, Linux, and macOS.

• Download slides for this talk
• Download paper for this talk

Peter Kálnai Peter Kálnai is a senior malware researcher at ESET. As a speaker, he has presented his malware research at various international conferences including Virus Bulletin, AVAR and CARO Workshop. He earned his Ph.D. in mathematics at Charles University in Prague in 2020. In his free time he enjoys foosball and travelling.

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers