Microsoft security experts warn that Lazarus is back.
Lazarus Group, a well-known North Korean threat actor, has been observed carrying out a highly sophisticated, targeted malware attack that involves compromising popular open-source software and running spear phishing campaigns.
As a result, it has managed to compromise “numerous” organizations in the media, defense, and aerospace, as well as IT, and services industries, according to a Microsoft report (opens in new tab).
According to the company, Lazarus (or ZINC, as the group is known) compromised PuTTY, among other open-source applications, with malicious code that installs spyware. PuTTY is a terminal emulator, serial console, and network file transfer application that is free and open source.
Installing ZetaNile
However, simply compromising open-source software does not guarantee access to the target organization’s endpoints; users must still download and run the software. This is where spear-phishing comes into play. Threat actors use a highly targeted social engineering attack on LinkedIn to convince specific individuals working at target companies to download and run the app. Members of the group pose as recruiters on LinkedIn, offering people lucrative job opportunities.
The app was designed specifically to avoid detection. The ZetaNile espionage malware is only launched when the app connects to a specific IP address and logs in with a unique set of login credentials.
In addition to PuTTY, Lazarus compromised KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording.
“Since June 2022, the actors have successfully compromised numerous organizations,” members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a blog post. “Because of the widespread use of the platforms and software used by ZINC in this campaign, ZINC could pose a significant threat to individuals and organizations in a variety of sectors and regions.”
Lazarus is no stranger to bogus job offers. After all, the group has been doing the same thing for crypto developers and artists, posing as recruiters for companies like Crypto.com and Coinbase.
