lazarusholic

Everyday is lazarus.dayβ

CiscoTalos

@talossecurity, https://talosintelligence.com

Actors

Name Named by AKA First seen Last seen
Group123 CiscoTalos ScarCruft 2018-01-16 2025-05-14
Group77 CiscoTalos Lazarus 2016-02-24 2019-09-13
Konni CiscoTalos - 2017-05-03 2026-03-15
LilacSquid CiscoTalos - 2024-05-30 2024-10-03
UAT-10027 CiscoTalos Lazarus 2026-02-26 2026-02-26
UAT-4820 CiscoTalos LilacSquid 2024-05-30 2024-06-13
UAT-5394 CiscoTalos Kimsuky 2024-08-21 2024-09-02

Reports

2026-04-14
CiscoTalos
State-sponsored threats: Different objectives, similar access paths
#ITWorker #Trend
2026-04-03
CiscoTalos
Axios NPM supply chain incident
#Axios #NPM
2026-02-26
CiscoTalos
New Dohdoor malware campaign targets education and health care
#Dohdoor #UAT-10027
2025-10-16
CiscoTalos
BeaverTail and OtterCookie evolve with a new Javascript module
#BeaverTail #OtterCookie #FamousChollima
2025-06-18
CiscoTalos
Famous Chollima deploying Python version of GolangGhost RAT
#ClickFix #FamousChollima #PylangGhost
2024-08-21
CiscoTalos
MoonPeak malware from North Korean actors unveils new details on attacker infrastructure
#MoonPeak #UAT-5394 #XenoRAT
2024-05-30
CiscoTalos
LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader
#InkBox #InkLoader #LilacSquid #MeshAgent #UAT-4820 #PurpleInk #QuasarRAT
2023-12-11
CiscoTalos
Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
#Andariel #NineRAT #Blacksmith #DLRAT #CVE-2021-44228
2023-08-24
CiscoTalos
Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT
#CVE-2022-47966 #QuiteRAT
2023-08-24
CiscoTalos
Lazarus Group's infrastructure reuse leads to discovery of new malware
#CVE-2022-47966 #Andariel #CollectionRAT
2023-03-30
CiscoTalos
Threat Advisory: 3CX Softphone Supply Chain Compromise
#SupplyChain #3CXDesktopApp #SmoothOperator
2022-12-14
CiscoTalos
Talos Year in Review 2022
#Trend
2022-09-08
CiscoTalos
Lazarus and the tale of three RATs
#VSingle #MagicRAT #YamaBot
2022-09-07
CiscoTalos
MagicRAT: Lazarus’ latest gateway into victim networks
#MagicRAT
2021-11-10
CiscoTalos
North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets
#Kimsuky #GoldDragon #BravePrince
2021-01-26
CiscoTalos
Nation-state campaign targets Talos researchers
#DreamJob
2019-01-30
CiscoTalos
Fake Cisco Job Posting Targets Korean Candidates
2018-05-31
CiscoTalos
NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea
#NavRAT
2018-04-02
CiscoTalos
Fake AV Investigation Unearths KevDroid, New Android Malware
#Mobile #KevDroid #Group123
2018-02-02
CiscoTalos
Flash 0 Day In The Wild: Group 123 At The Controls
#Group123 #CVE-2018-4878
2018-01-16
CiscoTalos
Korea In The Crosshairs
#RokRAT #Group123
2017-11-28
CiscoTalos
ROKRAT Reloaded
#RokRAT
2017-05-12
CiscoTalos
Player 3 Has Entered the Game: Say Hello to 'WannaCry'
#WannaCry
2017-05-03
CiscoTalos
KONNI: A Malware Under The Radar For Years
#Konni
2017-04-03
CiscoTalos
Introducing ROKRAT
#RokRAT
2017-02-23
CiscoTalos
Korean MalDoc Drops Evil New Years Presents
2016-02-24
CiscoTalos
Operation Blockbuster: Coverage for the Lazarus Group
#Blockbuster #Group77 #Lazarus
2014-12-17
CiscoTalos
Wiper Malware – A Detection Deep Dive
#Wiper
2009-07-16
CiscoTalos
7.7 DDoS 공격 유형 분석 및 대응방안
#7.7DDoS #DDoS #Finance #Government