Everyday is lazarus.dayβ

Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent)

2024-03-19, Ahnlab
#ModeLoader #Andariel #AndarLoader #MeshAgent


AhnLab SEcurity intelligence Center (ASEC) recently discovered the Andariel group’s continuous attacks on Korean companies. It is notable that installations of MeshAgent were found in some cases. Threat actors often exploit MeshAgent along with other similar remote management tools because it offers diverse remote control features.
The Andariel group exploited Korean asset management solutions to install malware such as AndarLoader and ModeLoader, which are the malware used in the previous cases. Starting with Innorix Agent in the past, the group has been continually exploiting Korean asset management solutions to distribute their malware during the lateral movement phase [1] [2].
1. AndarLoader
The ASEC team previously introduced AndarLoader in the past blog article, “Analysis of Andariel’s New Attack Activities” [3]. AndarLoader looks similar to Andardoor found in attack cases that exploited Innorix Agent, but unlike Andardoor which has most of the backdoor features (executing commands received from the C&C server) implemented in binary, AndarLoader …