Following the Lazarus group by tracking DeathNote campaign

2023-04-12 Kaspersky

https://securelist.com/the-lazarus-group-deathnote-campaign/109490/

Thumbnail for Following the Lazarus group by tracking DeathNote campaign

Kaspersky tracks Lazarus Group's DeathNote cluster, also associated with Operation DreamJob or NukeSped, from cryptocurrency-focused attacks into defense-related, automotive, academic, IT, and South Korean targets. Early activity used malicious cryptocurrency-themed Word documents that loaded downloader malware and follow-on backdoors, including Manuscrypt, while later operations used defense job lures, remote template injection, and Trojanized open-source PDF viewer software. The DeathNote downloader collected victim information and retrieved next-stage payloads such as COPPERHEDGE or BLINDINGCAN at the operator's direction. The report highlights Lazarus tradecraft evolution across lures, persistence, Trojanized applications, and in-memory payload execution.

Indicators of Compromise

Type Value First Seen Last Seen
HASH e7aa0237fc3db67a96ebd877806a2c88 2020-08-19 2025-08-13
HASH fe549a0185813e4e624104d857f9277b 2023-04-12 2023-04-12
HASH 2bcf464a333d67afeb80360da4dfd5bb 2023-04-12 2023-04-12
HASH 706e55af384e1d8483d2748107cbd57c 2023-04-12 2023-04-12
HASH 7af59d16cfd0802144795ca496e8111c 2023-04-12 2023-04-12
HASH 7b8960e2a22c8321789f107a7b83aa59 2023-04-12 2023-04-12
HASH 97336f5ce811d76b28e23280fa7320b5 2023-04-12 2023-04-12
HASH c278d6468896af3699e058786a8c3d62 2023-04-12 2023-04-12
HASH 0493f40628995ae1b7e3ffacd675ba5f 2023-04-12 2023-04-12
HASH cbc559ea38d940bf0b8307761ee4d67b 2023-04-12 2023-04-12
HASH eb2dc282ad3ab29c1853d4f6d09bec4f 2023-04-12 2023-04-12
HASH 26c0f0ce33f5088754d88a1db1e6c4a9 2023-04-12 2023-04-12
HASH 0d4bdfec1e657d6c6260c42ffdbb8cab 2023-04-12 2023-04-12
HASH 84cd4d896748e2d52e2e22d1a4b9ee46 2023-04-12 2023-04-12
HASH d4d654c1b27ab90d2af8585052c77f33 2023-04-12 2023-04-12
HASH dd185e2bb02b21e59fb958a4e12689a7 2023-04-12 2023-04-12
HASH ca6658852480c70118feba12eb1be880 2023-04-12 2023-04-12
HASH 64e5acf43613cd10e96174f36cb1d680 2023-04-12 2023-04-12
HASH 735afcd0f6821cbd3a2db510ea8feb22 2023-04-12 2023-04-12
HASH 2449f61195e39f6264d4244dfa1d1613 2023-04-12 2023-04-12
HASH 880b263b4fd5de0ae6224189ea611023 2023-04-12 2023-04-12
HASH b23b0de308e55cbf14179d59adee5fcb 2023-04-12 2023-04-12
HASH 8a05f6b3f1eb25bcbceb717aa49999cd 2023-04-12 2023-04-12
HASH 77194024294f4fd7a4011737861cce3c 2023-04-12 2023-04-12
HASH dc9244206e72a04d30eeadef23713778 2023-04-12 2023-04-12
HASH 9ea365c1714eb500e5f4a749a3ed0fe7 2023-04-12 2023-04-12
HASH a43bdc197d6a273102e90cdc0983b0b9 2023-04-12 2023-04-12
HASH 9fd35bad075c2c70678c65c788b91bc3 2023-04-12 2023-04-12
HASH 8840f6d2175683c7ed8ac2333c78451a 2023-04-12 2023-04-12
HASH ced38b728470c63abcf4db013b09cff7 2023-04-12 2023-04-12
HASH 83dd9b600ed33682aa21f038380a6eab 2023-04-12 2023-04-12
HASH 7a307c57ec33a23ce9b5c84659f133cc 2023-04-12 2023-04-12
HASH 7d204793e75bb49d857bf4dbc60792d3 2023-04-12 2023-04-12
HASH 50b2154de64724a2a930904354b5d77d 2023-04-12 2023-04-12
HASH 9121f1c13955506e33894ffd780940cd 2023-04-12 2023-04-12
HASH 7a73a2261e20bdb8d24a4fb252801db7 2023-04-12 2023-04-12
HASH 9b09ebf52660a9d6deca21965ce52ca1 2023-04-12 2023-04-12
HASH 5da86adeec6ce4556f477d9795e73e90 2023-04-12 2023-04-12
HASH ee73a772b72a5f3393d4bf577fc48efe 2023-04-12 2023-04-12
HASH e9d89d1364bd73327e266d673d6c8acf 2023-04-12 2023-04-12
HASH f821ca4672851f02bead3c4bd23bed84 2023-04-12 2023-04-12
HASH eb061dfacb3667cf65d250911179235d 2023-04-12 2023-04-12
HASH 97524091ac21c327bc783fa5ffe9cd66 2023-04-12 2023-04-12
HASH da1dc5d41de5f241cabd7f79fbc407f5 2023-04-12 2023-04-12
HASH 0ac90c7ad1be57f705e3c42380cbcccd 2022-04-18 2023-04-12
HASH b974bc9e6f375f301ae2f75d1e8b6783 2022-04-18 2023-04-12
HASH adf0d4bbefccf342493e02538155e611 2022-04-18 2023-04-12
HASH b3a8c88297daecdb9b0ac54a3c107797 2021-07-08 2023-04-12
HASH 4088946632e75498d9c478da782aa880 2020-12-23 2023-04-12
HASH 56470e113479eacda081c2eeead153bf 2020-08-19 2023-04-12
HASH 8fc7b0764541225e5505fa93a7376df4 2020-05-15 2023-04-12
HASH cd5357d1045948ba62710ad8128ae282 2020-05-15 2023-04-12
HASH 1bd0ca304cdecfa3bd4342b261285a72 2020-05-15 2023-04-12
HASH 0071b20d27a24ae1e474145b8efc9718 2020-05-15 2023-04-12
HASH 265f407a157ab0ed017dd18cae0352ae 2020-05-15 2023-04-12
HASH c0a8483b836efdbae190cc069129d5c3 2020-05-15 2023-04-12
HASH 25b37c971fd7e9e50e45691aa86e5f0a 2020-05-15 2023-04-12
HASH 92657b98c2b4ee4e8fa1b83921003c74 2020-05-15 2023-04-12
HASH 59cb8474930ae7ea45b626443e01b66d 2020-05-15 2023-04-12
HASH 14d79cd918b4f610c1a6d43cadeeff7b 2020-05-15 2023-04-12
HASH 075fba0c098d86d9f22b8ea8c3033207 2020-05-15 2023-04-12
HASH d1c652b4192857cb08907f0ba1790976 2020-05-15 2023-04-12
HASH 78d42cedb0c012c62ef5be620c200d43 2020-05-15 2023-04-12
HASH 1f254dd0b85edd7e11339681979e3ad6 2020-05-15 2023-04-12
HASH f4b55da7870e9ecd5f3f565f40490996 2020-04-30 2023-04-12
HASH 2b02465b65024336a9e15d7f34c1f5d9 2020-04-30 2023-04-12
HASH 4c239a926676087e31d82e79e838ced1 2020-04-30 2023-04-12
HASH 183ad96b931733ad37bb627a958837db 2020-04-30 2023-04-12
HASH 65df11dea0c1d0f0304b376787e65ccb 2020-04-30 2023-04-12
HASH 2efbe6901fc3f479bc32aaf13ce8cf12 2020-04-30 2023-04-12
HASH f6d6f3580160cd29b285edf7d0c647ce 2020-04-30 2023-04-12
HASH 11fdc0be9d85b4ff1faf5ca33cc272ed 2020-04-30 2023-04-12

Related Reports

« Back