20190619_cecreport_sp.pdf (6 MB)

LAC profiled HYDSEVEN as a cryptocurrency-theft threat group active from 2016 through 2019 against targets in multiple countries, including Japan and Poland. The report describes spear-phishing as a common entry point, with Office VBA macros, Office/Windows exploit chains such as CVE-2015-2545, CVE-2016-7255, and CVE-2017-0199, and fake installer lures used to deliver malware. HYDSEVEN’s payloads included NetWire and Ekoms/Mokes, downloaded through PowerShell or HTA/VBScript stages and supported by overseas C2 infrastructure. The excerpt does not attribute the activity to DPRK actors, so the summary treats it as cryptocurrency-focused CTI context rather than a Lazarus attribution.