2022_APT_Activity_Analysis_Report_threatbook.pdf (11 MB)

ThreatBook's 2022 APT activity report includes a DPRK section covering Lazarus, Kimsuky, and Group123 alongside other regional threat actors. Its Lazarus case study focuses on poisoned IDA Pro 7.5 installers aimed at security researchers, where a malicious win_fw.dll component creates a scheduled task and launches idahelper.dll to decrypt C2 addresses and download later payloads. The broader report treats the activity as part of 2022 state backed APT operations affecting government, financial, diplomatic, military, and energy targets.