朝鲜APT组织Lazarus又又又对安全人员发起攻击 - 安恒威胁情报中心
2021-11-11 • 安恒信息 • North Korean APT organization Lazarus launches another attack on security personnel - Anheng Threat Intelligence Center •
https://starmap.dbappsecurity.com.cn/blog/articles/2021/11/11/lazarus-attack-researcher-again/
DBAPPSecurity summarized ESET’s disclosure that Lazarus targeted security researchers by distributing a trojanized IDA Pro 7.5 installer. The installer included modified `idahelper.dll` and `win_fw.dll` components; `win_fw.dll` created a scheduled task that launched the malicious plugin component from the IDA Plugins directory. The payload attempted to download a next-stage implant from `devguardmap[.]org`, which the source describes as NukeSped RAT capable of file theft, screenshots, keystroke logging, and command execution. The report ties the activity to Lazarus using malware and infrastructure overlaps and adds context from earlier researcher-targeting activity involving the `mavillon1` persona and CVE-2021-33739.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | de0e23db04a7a780a640c656293336f… | 2021-11-11 | 2021-11-11 |
| HASH | a8ef73cc67c794d5aa860538d668988… | 2021-11-11 | 2021-11-11 |
| URL | https://www.devguardmap.org/boa… | 2021-11-11 | 2021-11-11 |
| DOMAIN | devguardmap.org | 2021-03-31 | 2021-11-11 |