2023-11-10_상세_분석_보고서악성코드로_둔갑한_Putty.pdf (825 KB)

The source says Lazarus modified open source tools including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF or Subliminal Recording to deliver malware to engineers. Operators posed as recruiters on LinkedIn and targeted engineers at specific companies, using trojanized utilities that stayed quiet until the victim opened a specific PDF or connected to a particular server with the modified PuTTY. The event driven execution is presented as a sandbox evasion technique because the malware does not act maliciously on simple launch.