라자루스 APT 조직, 오퍼레이션 익스트림 잡(Extreme Job)으로 공격 수행

2019-01-31 • ESTSecurity • Lazarus APT group conducts attacks through Operation Extreme Job •

https://blog.alyac.co.kr/2105

Thumbnail for 라자루스 APT 조직, 오퍼레이션 익스트림 잡(Extreme Job)으로 공격 수행

ESTsecurity ESRC reports a Lazarus campaign it names Operation Extreme Job, using a malicious DOC lure with macro code techniques reused from earlier intrusions. The document name and code style overlap with prior ESRC reporting on Operation Arabian Night, suggesting tool and tradecraft reuse by the same threat set. The campaign shows continued use of Korean-language document lures and Office macro delivery in Lazarus-linked APT activity.

Indicators of Compromise

Type Value First Seen Last Seen
DOMAIN ilovesvc.com 2019-01-30 2022-03-31
DOMAIN syadplus.com 2019-01-31 2019-01-31
DOMAIN secuvision.co.kr 2019-01-31 2019-01-31
HASH bf27c1631ef64c1e75676375a85d48f… 2019-01-30 2019-01-31
HASH 809b1201b17a77732be3a9f96a25d64… 2019-01-30 2019-01-31

Related Actors

Related Reports

« Back