Emulating the Politically Motivated North Korean Adversary Andariel – Part 2
2024-07-31 • Attack IQ •
On December 11, 2023, Cisco Talos reported the discovery of an activity led by Andariel, a North Korean state-sponsored known to be a subgroup of the notorious Lazarus group, which employed three new DLang-based malware families. This activity consists of continued opportunistic targeting of enterprises that publicly host and expose their vulnerable infrastructure to n-day vulnerability exploitation. The adversary, a subgroup of the notorious Lazarus group, is suspected to be operating in support of the DPRK’s RGB 3rd Bureau. Operation Blacksmith involved the exploitation of CVE-2021-44228, also known as Log4Shell, and the use of a previously unknown DLang-based Remote Access Trojan (RAT) named NineRAT, which employs Telegram as its C2 channel.