Lazarus targets defense industry with ThreatNeedle

2021-02-25 Kaspersky

https://securelist.com/lazarus-threatneedle/100803/

Thumbnail for Lazarus targets defense industry with ThreatNeedle

Kaspersky reports that Lazarus used the ThreatNeedle malware cluster, an advanced Manuscrypt/NukeSped variant, in attacks against defense-industry organizations in more than a dozen countries. The campaign began with carefully tailored COVID-19-themed spear-phishing emails sent from lookalike accounts, including malicious Word documents or links and follow-up instructions to enable macros when the first attempt failed. After initial access, the attackers gathered credentials, moved laterally, and bypassed network segmentation by compromising an internal router machine as a proxy to exfiltrate intranet data to remote servers. The investigation also tied the infrastructure and scripts to other Lazarus campaigns and noted use of multiple C2 servers across attack stages.

Indicators of Compromise

Type Value First Seen Last Seen
HASH 254a7a0c1db2bea788ca826f4b5bf51a 2021-02-25 2025-08-13
HASH ac86d95e959452d189e30fa6ded05069 2021-02-25 2025-08-13
HASH 09580ea6f1fe941f1984b4e1e442e0a5 2021-02-25 2025-08-13
HASH 6f0c7cbd57439e391c93a2101f958ccd 2021-02-25 2025-08-13
HASH 0aceeb2d38fe8b5ef2899dd6b80bfc08 2021-02-25 2025-08-13
HASH bea90d0ef40a657cb291d25c4573768d 2021-02-25 2025-08-13
DOMAIN newidealupvc.com 2021-02-25 2025-08-13
DOMAIN cloudarray.com 2021-02-25 2025-08-13
DOMAIN prototypetrains.com 2021-02-25 2025-08-13
DOMAIN forum.iron-maiden.ru 2021-02-25 2025-08-13
HASH e7aa0237fc3db67a96ebd877806a2c88 2020-08-19 2025-08-13
URL https://www.gonnelli.it/uploads… 2020-12-15 2022-09-30
DOMAIN roit.co.kr 2021-02-25 2022-03-31
HASH fc9e7dc13ce7edc590ef7dfce12fe017 2021-02-25 2021-02-25
HASH 160d0e396bf8ec87930a5df46469a960 2021-02-25 2021-02-25
HASH 85621411e4c80897c588b5df53d26270 2021-02-25 2021-02-25
HASH aa74ed16b0057b31c835a5ef8a105942 2021-02-25 2021-02-25
HASH a611d023dfdd7ca1fab07f976d2b6629 2021-02-25 2021-02-25
HASH 16824dfd4a380699f3841a6fa7e52c6d 2021-02-25 2021-02-25
HASH 110e1c46fd9a39a1c86292487994e5bd 2021-02-25 2021-02-25
URL https://www.dellarocca.net/it/c… 2021-02-25 2021-02-25
URL https://martiancartel.com/forum… 2021-02-25 2021-02-25
URL https://cloudarray.com/images/l… 2021-02-25 2021-02-25
URL https://forum.snowreport.gr:443… 2021-02-25 2021-02-25
URL http://forum.iron-maiden.ru/cor… 2021-02-25 2021-02-25
URL http://www.kwwa.org/DR6001/FN60… 2021-02-25 2021-02-25
URL https://www.waterdoblog.com/upl… 2021-02-25 2021-02-25
URL https://www.edujikim.com/smarte… 2021-02-25 2021-02-25
URL http://roit.co.kr/xyz/mainpage/… 2021-02-25 2021-02-25
URL https://www.geeks-board.com/blo… 2021-02-25 2021-02-25
URL https://theforceawakenstoys.com… 2021-02-25 2021-02-25
URL https://polyboatowners.com/2010… 2021-02-25 2021-02-25
URL http://www.sanatoliacare.com/in… 2021-02-25 2021-02-25
URL https://www.polyboatowners.com/… 2021-02-25 2021-02-25
URL http://www.djasw.or.kr/sub/popu… 2021-02-25 2021-02-25
URL https://prototypetrains.com:443… 2021-02-25 2021-02-25
URL https://www.lyzeum.com/images/b… 2021-02-25 2021-02-25
URL http://www.au-pair.org/admin/Ne… 2021-02-25 2021-02-25
URL http://www.au-pair.org/admin/lo… 2021-02-25 2021-02-25
URL https://shinwonbook.co.kr/baske… 2021-02-25 2021-02-25
URL https://docentfx.com/wp-admin/i… 2021-02-25 2021-02-25
URL http://www.juvillage.co.kr/img/… 2021-02-25 2021-02-25
URL https://www.raiestatesandbuilde… 2021-02-25 2021-02-25
URL https://ryanmcbain.com/forum/co… 2021-02-25 2021-02-25
URL https://www.digitaldowns.us/art… 2021-02-25 2021-02-25
URL https://www.edujikim.com/pay/sa… 2021-02-25 2021-02-25
URL https://mdim.in.ua:443/core/cac… 2021-02-25 2021-02-25
URL https://www.edujikim.com/intro/… 2021-02-25 2021-02-25
URL https://kannadagrahakarakoota.o… 2021-02-25 2021-02-25
URL https://www.lyzeum.com/board/bb… 2021-02-25 2021-02-25
URL https://americanhotboats.com/fo… 2021-02-25 2021-02-25
URL https://shinwonbook.co.kr/board… 2021-02-25 2021-02-25
URL http://fredrikarnell.com/marock… 2021-02-25 2021-02-25
URL http://www.kwwa.org/popup/16030… 2021-02-25 2021-02-25
URL http://www.kbcwainwrightchallen… 2021-02-25 2021-02-25
URL https://newidealupvc.com:443/im… 2021-02-25 2021-02-25
DOMAIN docentfx.com 2021-02-25 2021-02-25
DOMAIN mdim.in.ua 2021-02-25 2021-02-25
DOMAIN fredrikarnell.com 2021-02-25 2021-02-25
DOMAIN forum.snowreport.gr 2021-02-25 2021-02-25
DOMAIN polyboatowners.com 2021-02-25 2021-02-25
DOMAIN martiancartel.com 2021-02-25 2021-02-25
DOMAIN ryanmcbain.com 2021-02-25 2021-02-25
DOMAIN kannadagrahakarakoota.org 2021-02-25 2021-02-25
DOMAIN americanhotboats.com 2021-02-25 2021-02-25
DOMAIN theforceawakenstoys.com 2021-02-25 2021-02-25
DOMAIN shinwonbook.co.kr 2021-02-25 2021-02-25
IPv4 156.245.16.55 2021-02-25 2021-02-25
URL https://www.fabioluciani.com/ae… 2021-01-28 2021-02-25
URL https://www.dronerc.it/shop_tes… 2021-01-28 2021-02-25
URL http://www.colasprint.com/_vti_… 2021-01-25 2021-02-25
URL https://www.dronerc.it/forum/up… 2021-01-25 2021-02-25
URL https://www.fabioluciani.com/es… 2021-01-25 2021-02-25
URL https://www.astedams.it/photos/… 2020-12-15 2021-02-25
URL https://www.sanlorenzoyacht.com… 2020-09-29 2021-02-25
URL https://www.automercado.co.cr/e… 2020-08-19 2021-02-25
URL https://www.curiofirenze.com/in… 2020-08-19 2021-02-25

Related Actors

Related Reports

2025-08-13 • 47% Match
#Lazarus #T1102.002 #T1082 #T1059.003 #T1567.002 #T1140 #T1584.004 #T1005 #T1070.004 #T1587.001 #T1041 #T1560 #T1608.001 #T1071.001 #T1046 #T1083 #T1056.001 #T1204.001 #T1036 #T1027 #T1204.002 #T1566.002 #T1566.003 #T1124 #T1057 #T1059.005 #T1583.006 #T1566.001 #T1547.001 #T1585.002 #T1053.005 #T1583.001 #T1059.001 #T1036.005 #T1132.001 #T1001.003 #T1585.001 #T1497.001 #T1105 #T1553.002 #T1620 #T1574.002 #T1562.001 #T1027.002 #T1489 #T1078 #T1008 #T1571 #T1491.001 #T1218 #T1220 #T1203 #T1189 #T1049 #T1564.001 #T1098 #T1016 #T1074.001 #T1588.002 #T1562.004 #T1591 #T1218.011 #T1583.004 #T1036.004 #T1588.003 #T1218.010 #T1593.001 #T1218.005 #T1589.002 #T1584.001 #T1070.006 #T1048.003 #T1134.002 #T1027.007 #T1021.001 #T1106 #T1090.001 #T1573 #T1070 #T1047 #T1574.013 #T1561.001 #T1036.003 #T1529 #T1055.001 #T1614.001 #T1010 #T1021.002 #T1033 #T1543.003 #T1485 #T1090.002 #T1542.003 #T1560.002 #T1012 #T1110 #T1547.009 #T1110.003 #T1534 #T1588.004 #T1104 #T1591.004 #T1561.002 #T1608.002 #T1202 #T1221 #T1557.001 #T1087.002 #T1560.003 #T1070.003 #T1021.004
Shares tags: Lazarus, T1082, T1059.003
2021-12-02 • 47% Match
#Lazarus #T1102.002 #T1082 #T1059.003 #T1567.002 #T1140 #T1584.004 #T1005 #T1070.004 #T1587.001 #T1041 #T1560 #T1608.001 #T1071.001 #T1046 #T1083 #T1056.001 #T1204.001 #T1036 #T1027 #T1204.002 #T1566.002 #T1566.003 #T1124 #T1057 #T1059.005 #T1583.006 #T1566.001 #T1547.001 #T1585.002 #T1053.005 #T1583.001 #T1059.001 #T1036.005 #T1132.001 #T1001.003 #T1585.001 #T1497.001 #T1105 #T1553.002 #T1620 #T1574.002 #T1562.001 #T1027.002 #T1489 #T1078 #T1008 #T1573.001 #T1571 #T1491.001 #T1218 #T1220 #T1203 #T1189 #T1049 #T1564.001 #T1098 #T1016 #T1074.001 #T1588.002 #T1562.004 #T1591 #T1218.011 #T1583.004 #T1036.004 #T1588.003 #T1593.001 #T1218.005 #T1589.002 #T1584.001 #T1070.006 #T1048.003 #T1134.002 #T1027.007 #T1021.001 #T1106 #T1090.001 #T1070 #T1047 #T1574.013 #T1561.001 #T1036.003 #T1529 #T1055.001 #T1614.001 #T1010 #T1021.002 #T1033 #T1543.003 #T1485 #T1090.002 #T1542.003 #T1560.002 #T1012 #T1110 #T1547.009 #T1110.003 #T1534 #T1588.004 #T1104 #T1591.004 #T1561.002 #T1608.002 #T1202 #T1221 #T1557.001 #T1087.002 #T1560.003 #T1070.003 #T1021.004 #T0865
Shares tags: Lazarus, T1082, T1059.003
« Back