WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf (3 MB)

WithSecure attributes the Q4 2022 “No Pineapple” intrusion with high confidence to Lazarus Group, targeting public and private research organizations, medical research, energy-sector entities, and their supply chain for likely intelligence collection. Initial compromise and privilege escalation came through exploitation of unpatched Zimbra devices, followed by web shells, custom binaries, living-off-the-land Windows and Unix tooling, proxying, tunneling, and relay infrastructure. The actor used tooling including Grease, Dtrack, 3Proxy, Stunnel, bind shells, Mimikatz, and web shells, and exfiltrated roughly 100GB of data before disruption. WithSecure’s attribution is grounded in malware and TTP overlaps, time-zone analysis, infrastructure overlap, and an operational-security mistake.