#OdicLoader

Malware/Tool

2023-04-20 • Linux malware strengthens links between Lazarus and the 3CX supply‑chain attack

OdicLoader is a Linux ELF downloader associated with Selective Pisces and first observed in 2023. It masquerades as a PDF by replacing the normal period before the pdf extension with the visually similar Unicode U+2024 character, causing graphical Linux file managers to execute the ELF when a victim double-clicks it. OdicLoader opens a decoy PDF through xdg-open, then downloads and executes a next-stage payload; it has been linked to Operation DreamJob.

3

Tagged Reports
3

Unique Authors
509

Active Days

Tagged Reports

2024-09-09

Paloalto Networks

Threat Assessment: North Korean Threat Groups

#AlluringPisces #CollectionRAT #Comebacker #Fullhouse #GleamingPisces #JumpyPisces #KANDYKORN #ObjCShellz #OdicLoader #POOLRAT #PondRAT #RustBucket #SelectivePisces #SlowPisces #SmoothOperator #SparklingPisces

2023-05-09

Ecu CERT

Lazarus Operation DreamJob – Ataque a la cadena de suministro de 3CX

#SmoothOperator #DreamJob #T1134.002 #T1090 #T1573.001 #T1497.003 #T1140 #T1027.009 #T1585.003 #T1070.004 #T1587.001 #T1041 #T1132.001 #T1608.001 #T1204.002 #T1562.003 #T1071.001 #T1083 #T1546.004 #T1593.001 #T1566.002 #T1584.001 #3CXDesktopApp #Lazarus #OdicLoader #SimplexTea

2023-04-20

ESET

Linux malware strengthens links between Lazarus and the 3CX supply‑chain attack

#3CXDesktopApp #SmoothOperator #YARA #DreamJob #T1134.002 #T1090 #T1573.001 #T1497.003 #T1140 #T1027.009 #T1585.003 #T1070.004 #T1587.001 #T1041 #T1132.001 #T1608.001 #T1204.002 #T1562.003 #T1071.001 #T1083 #T1546.004 #T1593.001 #T1566.002 #T1584.001 #Lazarus #OdicLoader #SimplexTea

« Back