lazarusholic

Everyday is lazarus.dayβ

#YARA

General

Reports

2024-12-06
Proofpoint
A Better Way, YARA-X, Mach-O Feature Extraction, and Malware Similarity
#Youtube #AppleJeus #BlueNoroff #TraderTraitor #YARA
2024-11-13
Group-IB
Stealthy Attributes of APT Lazarus: Evading Detection with Extended Attributes
#Lazarus #RustyAttr #macOS #YARA
2024-07-25
USCISA
North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs
#YARA #Andariel
2024-06-07
Dimitribest
Kimsuky is targeting an arms manufacturer in Europe
#Kimsuky #YARA
2024-06-05
ErvinZubic
Can We Adapt YARA to Fight DeFi Attacks? A Lazarus Group Case Study Sparks the Question
#DeFi #YARA
2024-03-25
Logpresso
Kimsuky의 TrollAgent를 탐지하는 YARA rule 작성가이드
#Kimsuky #TrollAgent #YARA
2024-03-17
Cyberpoking
H0lyGh0st (SiennaPurple) Ransomware
#H0lyGh0st #YARA
2024-03-14
RustyNoob619
Detects a malicious DLL used by a North Korean Threat actor Lazarus
#YARA
2024-03-12
somedieyoungZZ
Kimsuky 3
#Kimsuky #YARA
2024-03-07
knight0x07
Kimsuky-PS-Backdoor: Kimsuky PowerShell Backdoor Analysis
#Kimsuky #YARA
2024-02-19
KRNCSC
韓獨 합동 사이버 보안 권고문(北 방산분야 해킹)
#News #YARA
2024-01-04
GregLesewich
100DaysofYARA - CosmicRust
#TA444 #CosmicRust #YARA
2024-01-03
GregLesewich
100DaysofYARA - SpectralBlur
#KANDYKORN #TA444 #YARA #SpectralBlur
2024-01-01
GregLesewich
100DaysofYARA - In Memory Detection
#YARA #TA430
2023-04-20
Mandiant
3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible
#SupplyChain #UNC4736 #YARA #3CXDesktopApp #SmoothOperator #X_Trader #UNC4469 #UNC3782
2023-04-20
ESET
Linux malware strengthens links between Lazarus and the 3CX supply‑chain attack
#3CXDesktopApp #SmoothOperator #YARA #DreamJob
2023-04-11
3CX
Security Update Mandiant Initial Results
#SupplyChain #YARA #UNC4736 #TAXHAUL #3CXDesktopApp #SmoothOperator
2023-03-30
NextronSystems
YARA rule set related to the 3CX incident
#SupplyChain #3CXDesktopApp #SmoothOperator #YARA
2023-03-30
Huntress
3CX VoIP Software Compromise & Supply Chain Threats
#SupplyChain #3CXDesktopApp #SmoothOperator #YARA
2023-03-09
Mandiant
Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970
#LIGHTSHOW #UNC2970 #YARA #BYOVD #UNC577
2023-03-09
Mandiant
Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW
#YARA #BYOVD #UNC2970 #LIGHTSHIFT #LIGHTSHOW
2023-01-18
GregLesewich
Writing Rules for Non-Objective C Malware
#YARA #Dacls #MATA
2023-01-16
GregLesewich
YARA-ing with MacOS
#YARA #APT37 #CloudMensis #RokRAT
2022-04-21
Stairwell
The ink-stained trail of GOLDBACKDOOR
#APT37 #GoldBackdoor #YARA
2020-12-15
Hvs-consulting
Greetings from Lazarus
#YARA #Lazarus #Whitepaper
2020-08-18
F-Secure
Lazarus group Campaign Targeting The Cryptocurrency Vertical
#Cryptocurrency #Whitepaper #YARA
2020-05-15
Malwarelab
In depth analysis of Lazarus validator
#YARA
2018-02-15
Alienvault
North Korean Cyber-Attacks and Collateral Damage
#YARA
2018-02-02
Flashpoint-intel
Targeted Attacks Against South Korean Entities May Have Been as Early as November 2017
#CVE-2018-4878 #YARA
2018-01-08
Alienvault
A North Korean Monero Cryptocurrency Miner
#YARA #Miner
2017-12-21
USCISA
North Korean Trojan: BANKSHOT
#HiddenCobra #Bankshot #YARA
2017-11-14
USCISA
HIDDEN COBRA – North Korean Trojan: Volgmer
#HiddenCobra #Volgmer #YARA
2017-11-14
USCISA
HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL
#HiddenCobra #FALLCHILL #YARA