f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf (2 MB)

F-Secure investigated a Lazarus Group intrusion against an organization in the cryptocurrency sector and tied it to a broader phishing campaign active since at least January 2018. Initial access came through a LinkedIn-delivered job advert lure that used a malicious Word macro, an LNK file, mshta, bit.ly redirection, VBScript, and PowerShell to retrieve further payloads. The operators deployed Themida-packed network backdoors, a custom PE loader registered through the LSA Security Packages mechanism, and main implants loaded into lsass.exe that could download files, execute commands, communicate with C2, and steal credentials. The intrusion also showed strong operational security: Lazarus disabled Windows Defender controls, used Mimikatz-style credential theft, modified registry settings, and securely deleted tooling and logs, leaving EDR telemetry as a key evidence source.