Lazarus Group Recruitment: Threat Hunters vs Head Hunters
Contents
Contents
Introduction
At the end of September 2020, Positive Technologies Expert Security Center (PT Expert Security Center, PT ESC) was involved in the investigation of an incident in one of the largest pharmaceutical companies. After starting to analyze the tactics, techniques, and procedures (TTPs) of the attackers, the investigation team found similarities with the Lazarus Group attacks previously described in detail by cybersecurity experts in the reports Operation: Dream Job and "Operation (노스 스타) North Star A Job Offer That's Too Good to be True?".
This article describes a previously unknown attack by the APT group, reveals the Lazarus Group's TTPs that allowed attackers to obtain partial control over a pharmaceutical company's infrastructure in just four days, as well as the tools used by the attackers for preliminary compromise, network reconnaissance, and gaining persistence in the infrastructure of the targeted company.
At the end of the article, PT ESC provides a list of the …
Introduction
At the end of September 2020, Positive Technologies Expert Security Center (PT Expert Security Center, PT ESC) was involved in the investigation of an incident in one of the largest pharmaceutical companies. After starting to analyze the tactics, techniques, and procedures (TTPs) of the attackers, the investigation team found similarities with the Lazarus Group attacks previously described in detail by cybersecurity experts in the reports Operation: Dream Job and "Operation (노스 스타) North Star A Job Offer That's Too Good to be True?".
This article describes a previously unknown attack by the APT group, reveals the Lazarus Group's TTPs that allowed attackers to obtain partial control over a pharmaceutical company's infrastructure in just four days, as well as the tools used by the attackers for preliminary compromise, network reconnaissance, and gaining persistence in the infrastructure of the targeted company.
At the end of the article, PT ESC provides a list of the …
IoC
02546fae0355905d341dedb15efa1815b813d3ecab6d9bc920c5446705149fa8
04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c
058542975392c9636371b88a3f6142d7
0dba9eaac49d78c6913bb4cf246642d8842f8c5e3e4e291fec95710362f3196d
107953faf48823913b19ab7cf311a2c8
1174fd03271f80f5e2a6435c72bdd0272a6e3a37049f6190abf125b216a83471
118.128.190.191
12011c44955fd6631113f68a99447515
150.60.192.67
160.153.142.0
162.241.219.119
164.46.106.43
166.62.39.82
17f1c3dc3ad9e0e87e6a131bd93d12c074b443f365eea2e720b9d9939f9ce22e
182.48.49.233
188415339edc3b54f6627f57bc77d4d500a670a3
192.168.129.92
198.133.183.67
1d24d431daf8566a84432a149989c43f57c4a5ef
23.152.0.232
277962f69a26cc7ac55e9dceb83af9d1
2a0da707ab46c53d9af2f059c3150c62
2aa3fd1c4b1036efc75bd422875c170a9d2f54c4640213898332579b04f97eac
2e83293e8da65d54253ca3b5bd87c414
30cc1612fa94be4e02a5c22b2cfbc1560d6e5bf32de9d8b37460f95a57279c3c
385b758ae75075b540943ce94d6c659f77b9ae3c13dbf2ca1a4584a663938515
3af010659d19b69d8fbc9b9bb917f603
3ccec13409045f9a6903a3bee1db474c75f959fe
415cd5c206baf793708952777ae0c987
4610a559b21b7e5e62925c115863e82ffa0b8977
480012756ad26f72e412db0ae7aa183e
4b404db4dbdf9240926fc9f3225e4cdd3a9f443c
4f4f8cf0f9b47d0ad95d159201fe7e72fbc8448d
54.64.30.175
56f5252ea7b10a8a2ec0e8b727bb4e85fa2a06512d7e73ca1f3f87cf7b7afafe
5f77737c1f4bd8b1868dc50efce1bbf5
610960413c81cf391a8f28fb83b2482f446953ca
66037fc3c489d099107e2d3cddd33569
665ce00318552c6ddc22e2f5e59cd516
6db80e381260eab8c93ee51bed40b1d5c38601bb
6e815cacb43c9bc055399a4fd4922ebc
6e8728af6cc4a7daa06e4ced52a8f45ec6229fd8
71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf
73a2aed35aa5fc8621828e11c76d58144ea7f6bb
7434c5de43c561780965ba8897a27caaa12944b7b3b135952e622da7189a5f9e
74c71671764610245a392f7e7444694c
75bf8feeac2b5b1690feab45155a6b97419d6d1b0d36083daccb061dc5dbdea8
79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9
7d235c717a031fc7941525b9ea8f5250a9a3e08a179caf26036fc8acae68fbe9
7e37d83efd01785acecb1c1748081d3ba3bd3e5d11436b930f0157b39639fcfa
7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da
8ec9ff02b58559c851b59189a9d57124
8ed89d14dee005ea59634aade15dba97
92.249.45.182
93d78712eb3f9e81286a9ebcffe6296ef05eb20dd53a76c16f6fb5384b0baf26
963e8cfaa40226ba2e5d516464572446
994c02f8c721254a959ed9bc823ab94b
9952c3fa4bce7ef68f8f6a50a593c8ead2481488
9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44
a63d7e501a17c8917ef96d4b31fa100b
a7e34ed64337893752eadfbfae9a516c8b482329
b2b8a0f74500bc0a93a7e54b06de5020
b42b60fc26bce51269ba6641fdf406a3491e6c6d
bc1e06ba5f472aaf30d8027dc8562307
bc54765b4790b5a0a24768453d7345bf85848deb4f3a208ce97e79e8da03f866
bc731ade86b380e87eb6188b7f2b4255
c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369
c2c399e9e78dbe447c3971014881ca05
c3a6e07ab16c8c887368ec65bed759f4690efcb539eb6a0904db005d1fe25427
c5abf0f2903b0549c20a8f964af7c4d24e730d9a
c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8
c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3
cca1ee1d92f7dac86077b7b826f0f57498811bec7ef149d08ccdd59893797684
ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b
d28318b4ab7a9076eed8f20306ddf68731ed2357
d6b7cdd046f0c185e9064e6be4a480a4f4d1987647a14076ccbf8af10a9ae755
e13888eed2466efaae729f16fc8e348fbabea8d7acd6db4e062f6c0930128f8f
e5ff537666b387c39a406cbbb359b2ed
e7526de25b1f759c7a7bbe61095cfebbae7c158d
e8ae38308c499577ad36758655e62ce069c1e303c7d301427d131b3a4a9ed9ea
e8cdac8acff9a39d016095c165b7c366e93adec5
e924b7c21b298ab185de26b0b28457b02e6cc1f7e42d241805f80d549c4e86ba
e9e691f11cfecb706c29f729ae660240ee9acbcb
ea93acf0c278dd59e29ae1402d35db8e0f3ae966
ea9ff940a65e650ef2090148b0e67853
fc64890ac49970cccdc80826d40e50f50b5d5b6f
fcaead308afb9cc4fb31c10ec345b4607f2e2430f83f0a8525f352d72a3af540
fe1894d343484cb3dc7ec16bef8252bd64cb7b6e
http://clicktocareers.com
http://forecareer.com:443
http://gbflatinamerica.com/file/filelist.php
http://goldllama4.sakura.ne.jp/waterdo/wp/wp-content/plugins/view.php
http://www.apars-surgery.org/bbs/bbs_files/board_blog/write.php
http://www.ctevt.org.np/ctevt/public/frontend/review.php
https://akramportal.org/delv/public/voice/voice.php
https://bootcamp-coders.cnm.edu/~dmcdonald21/emoji-review/storage/app/humor.php
https://generaldynamics.uk.com/,Home
https://generaldynamics.uk.com/about/about-us/,About
https://generaldynamics.uk.com/systems/,See
https://generaldynamics.uk.com/work/,Work
https://generaldynamics.uk.com/work/careers/,Careers
https://generaldynamics.uk.com/work/careers/current-vacancies/,Current
https://generaldynamics.uk.com/work/careers/project-management/,Project
https://inovecommerce.com.br/public/pdf/view.php
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=10931
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=12314
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=77234
https://mail.yandex.ru/?uid=*********#message/***************
https://mail.yandex.ru/?uid=*********#message/***************,Message
https://mail.yandex.ru/?uid==*********#message/***************,Message
https://propro.jp/wp-content/documents/docsmgmt.php
https://ru.wikipedia.org/wiki/General_Dynamics,General
https://vega.mh-tec.jp/.well-known/gallery/siteview.php
https://www.forecareer.com/gdcareer/officetemplate-20nab.asp?iqxml=480012756ad26f72e412db0ae7aa183e
https://www.hospitality-partners.co.jp/works/performance/consumer.php
https://yandex.ru/search/?lr=16&text=%20General%20Dynamics%20UK%20Ltd%20
https://yandex.ru/search/?text=%20General%20Dynamics%20UK%20Ltd%20&lr=16
04bc9e74c65b6df6f6c4ba90db3d85ca9b2dda4c
058542975392c9636371b88a3f6142d7
0dba9eaac49d78c6913bb4cf246642d8842f8c5e3e4e291fec95710362f3196d
107953faf48823913b19ab7cf311a2c8
1174fd03271f80f5e2a6435c72bdd0272a6e3a37049f6190abf125b216a83471
118.128.190.191
12011c44955fd6631113f68a99447515
150.60.192.67
160.153.142.0
162.241.219.119
164.46.106.43
166.62.39.82
17f1c3dc3ad9e0e87e6a131bd93d12c074b443f365eea2e720b9d9939f9ce22e
182.48.49.233
188415339edc3b54f6627f57bc77d4d500a670a3
192.168.129.92
198.133.183.67
1d24d431daf8566a84432a149989c43f57c4a5ef
23.152.0.232
277962f69a26cc7ac55e9dceb83af9d1
2a0da707ab46c53d9af2f059c3150c62
2aa3fd1c4b1036efc75bd422875c170a9d2f54c4640213898332579b04f97eac
2e83293e8da65d54253ca3b5bd87c414
30cc1612fa94be4e02a5c22b2cfbc1560d6e5bf32de9d8b37460f95a57279c3c
385b758ae75075b540943ce94d6c659f77b9ae3c13dbf2ca1a4584a663938515
3af010659d19b69d8fbc9b9bb917f603
3ccec13409045f9a6903a3bee1db474c75f959fe
415cd5c206baf793708952777ae0c987
4610a559b21b7e5e62925c115863e82ffa0b8977
480012756ad26f72e412db0ae7aa183e
4b404db4dbdf9240926fc9f3225e4cdd3a9f443c
4f4f8cf0f9b47d0ad95d159201fe7e72fbc8448d
54.64.30.175
56f5252ea7b10a8a2ec0e8b727bb4e85fa2a06512d7e73ca1f3f87cf7b7afafe
5f77737c1f4bd8b1868dc50efce1bbf5
610960413c81cf391a8f28fb83b2482f446953ca
66037fc3c489d099107e2d3cddd33569
665ce00318552c6ddc22e2f5e59cd516
6db80e381260eab8c93ee51bed40b1d5c38601bb
6e815cacb43c9bc055399a4fd4922ebc
6e8728af6cc4a7daa06e4ced52a8f45ec6229fd8
71e5bb0e7f00bb11518e8d7f619f2b6c9fa09eaf
73a2aed35aa5fc8621828e11c76d58144ea7f6bb
7434c5de43c561780965ba8897a27caaa12944b7b3b135952e622da7189a5f9e
74c71671764610245a392f7e7444694c
75bf8feeac2b5b1690feab45155a6b97419d6d1b0d36083daccb061dc5dbdea8
79076febac7abad26ae1c570c4de41fb51c6a5a82b97ec5299005d8e9f66e5a9
7d235c717a031fc7941525b9ea8f5250a9a3e08a179caf26036fc8acae68fbe9
7e37d83efd01785acecb1c1748081d3ba3bd3e5d11436b930f0157b39639fcfa
7e454b22987d8901ab7fc2983d335da6ed4ac048298e3bcb7e3a123352bfc1da
8ec9ff02b58559c851b59189a9d57124
8ed89d14dee005ea59634aade15dba97
92.249.45.182
93d78712eb3f9e81286a9ebcffe6296ef05eb20dd53a76c16f6fb5384b0baf26
963e8cfaa40226ba2e5d516464572446
994c02f8c721254a959ed9bc823ab94b
9952c3fa4bce7ef68f8f6a50a593c8ead2481488
9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44
a63d7e501a17c8917ef96d4b31fa100b
a7e34ed64337893752eadfbfae9a516c8b482329
b2b8a0f74500bc0a93a7e54b06de5020
b42b60fc26bce51269ba6641fdf406a3491e6c6d
bc1e06ba5f472aaf30d8027dc8562307
bc54765b4790b5a0a24768453d7345bf85848deb4f3a208ce97e79e8da03f866
bc731ade86b380e87eb6188b7f2b4255
c1d6a5940045b7ff0063b85d89750979d8501d52815b0134fb556f2c12210369
c2c399e9e78dbe447c3971014881ca05
c3a6e07ab16c8c887368ec65bed759f4690efcb539eb6a0904db005d1fe25427
c5abf0f2903b0549c20a8f964af7c4d24e730d9a
c85c825f1e2ef66d83dc1cf011f8b2e6aee08fa8
c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3
cca1ee1d92f7dac86077b7b826f0f57498811bec7ef149d08ccdd59893797684
ceec993673d95fd0af326f1ef7268ebf375361118efe2ae561c0e59b36387c1b
d28318b4ab7a9076eed8f20306ddf68731ed2357
d6b7cdd046f0c185e9064e6be4a480a4f4d1987647a14076ccbf8af10a9ae755
e13888eed2466efaae729f16fc8e348fbabea8d7acd6db4e062f6c0930128f8f
e5ff537666b387c39a406cbbb359b2ed
e7526de25b1f759c7a7bbe61095cfebbae7c158d
e8ae38308c499577ad36758655e62ce069c1e303c7d301427d131b3a4a9ed9ea
e8cdac8acff9a39d016095c165b7c366e93adec5
e924b7c21b298ab185de26b0b28457b02e6cc1f7e42d241805f80d549c4e86ba
e9e691f11cfecb706c29f729ae660240ee9acbcb
ea93acf0c278dd59e29ae1402d35db8e0f3ae966
ea9ff940a65e650ef2090148b0e67853
fc64890ac49970cccdc80826d40e50f50b5d5b6f
fcaead308afb9cc4fb31c10ec345b4607f2e2430f83f0a8525f352d72a3af540
fe1894d343484cb3dc7ec16bef8252bd64cb7b6e
http://clicktocareers.com
http://forecareer.com:443
http://gbflatinamerica.com/file/filelist.php
http://goldllama4.sakura.ne.jp/waterdo/wp/wp-content/plugins/view.php
http://www.apars-surgery.org/bbs/bbs_files/board_blog/write.php
http://www.ctevt.org.np/ctevt/public/frontend/review.php
https://akramportal.org/delv/public/voice/voice.php
https://bootcamp-coders.cnm.edu/~dmcdonald21/emoji-review/storage/app/humor.php
https://generaldynamics.uk.com/,Home
https://generaldynamics.uk.com/about/about-us/,About
https://generaldynamics.uk.com/systems/,See
https://generaldynamics.uk.com/work/,Work
https://generaldynamics.uk.com/work/careers/,Careers
https://generaldynamics.uk.com/work/careers/current-vacancies/,Current
https://generaldynamics.uk.com/work/careers/project-management/,Project
https://inovecommerce.com.br/public/pdf/view.php
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=10931
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=12314
https://mail.clicktocareers.com/public/jobapplications/jdviewer.php?jd=77234
https://mail.yandex.ru/?uid=*********#message/***************
https://mail.yandex.ru/?uid=*********#message/***************,Message
https://mail.yandex.ru/?uid==*********#message/***************,Message
https://propro.jp/wp-content/documents/docsmgmt.php
https://ru.wikipedia.org/wiki/General_Dynamics,General
https://vega.mh-tec.jp/.well-known/gallery/siteview.php
https://www.forecareer.com/gdcareer/officetemplate-20nab.asp?iqxml=480012756ad26f72e412db0ae7aa183e
https://www.hospitality-partners.co.jp/works/performance/consumer.php
https://yandex.ru/search/?lr=16&text=%20General%20Dynamics%20UK%20Ltd%20
https://yandex.ru/search/?text=%20General%20Dynamics%20UK%20Ltd%20&lr=16