ThreatReport-Lazarus.pdf (1 MB)

HvS-Consulting described multiple 2020 intrusions against European manufacturing and electrical-industry customers that it attributed with high confidence to Lazarus/APT37 based on overlapping TTPs and IOCs. Patient-zero users were approached via LinkedIn in February 2020, and the report frames the incidents as a coordinated espionage campaign rather than isolated compromises. The observed activity included reuse of C2 and exfiltration infrastructure, compromised websites, process commands and tools, with the attacker focused on stealing selected information. The report maps the campaign across the MITRE ATT&CK lifecycle and provides command-and-control domains, filenames, hashes, process execution artifacts and YARA rules for defenders.