Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as…
- ATT&CK ID
- G0032
- Origin
- North Korea
- Weather family
- Sleet
- Techniques
- 69
- Tools
- 26
Also tracked as Labyrinth Chollima · HIDDEN COBRA · Guardians of Peace · ZINC · NICKEL ACADEMY · Diamond Sleet
Vulnerabilities it has exploited
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Org Information
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsDevelop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsDrive-by CompromisePhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterNative APIExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobValid AccountsAccount ManipulationPre-OS BootCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionValid AccountsAccount ManipulationAccess Token ManipulationCreate or Modify System ProcessBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionIndicator RemovalValid AccountsAccess Token ManipulationDeobfuscate/Decode Files or InformationIndirect Command ExecutionSystem Binary Proxy ExecutionPre-OS BootHide ArtifactsHijack Execution FlowReflective Code Loading
Defense Impairment
Subvert Trust ControlsDisable or Modify ToolsDisable or Modify System Firewall
Credential Access
Input CaptureBrute ForceAdversary-in-the-Middle
Discovery
Application Window DiscoveryQuery RegistrySystem Network Configuration DiscoverySystem Owner/User DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySystem Time DiscoveryLocal Storage Discovery
Lateral Movement
Collection
Data from Local SystemInput CaptureData StagedAdversary-in-the-MiddleArchive Collected Data
Command and Control
Data ObfuscationFallback ChannelsApplication Layer ProtocolProxyWeb ServiceMulti-Stage ChannelsIngress Tool TransferData EncodingNon-Standard PortEncrypted Channel
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Alternative Protocol
Impact
Data DestructionService StopDefacementSystem Shutdown/RebootDisk Wipe
Software
AppleJeus · AuditCred · BADCALL · BLINDINGCAN · Bankshot · Cryptoistic · Dacls · Dtrack · ECCENTRICBANDWAGON · FALLCHILL · HARDRAIN · HOPLIGHT · HotCroissant · KEYMARBLE · MagicRAT · Proxysvc · RATANKBA · RawDisk · Responder · TAINTEDSCRIBE · TYPEFRAME · ThreatNeedle · Volgmer · WannaCry · netsh · route