A cascade of compromise: unveiling Lazarus’ new campaign

MITRE Techniques

• [T1189] Drive-by Compromise – used to gain initial access by exploiting legitimate security software: (‘A software vendor was compromised through the exploitation of another high-profile software.’)
• [T1203] Exploitation for Client Execution – shellcode found inside legitimate process memory launched a Windows executable directly in memory: (‘we discovered the presence of the SIGNBT malware accompanied by a shellcode. This shellcode was responsible for launching a Windows executable file directly in memory.’)
• [T1547.012] Boot or Logon Autostart Execution: Windows Service – persistence via ualapi.dll placed in system folder and loaded by spoolsv.exe at boot: (‘creation of a file called ualapi.dll in the system folder, which is automatically loaded by the spoolsv.exe process at each system boot.’)
• [T1574.002] DLL Side‑Loading – registry entries and legitimate files were used to side‑load malicious DLLs for persistence and execution: (‘registry entries were recorded to execute legitimate files for the purpose of malicious side-loading’)
• [T1140] Deobfuscation/Compression – malware uses AES decryption and base64-encoded configuration to conceal payloads and settings: (‘The loader process retrieves the first 32 bytes … and uses this data as an AES decryption key to decrypt the remaining contents.’ / ‘Inside this file is a base64-encoded string’)
• [T1027.001] Obfuscated Files or Information: Binary Padding – use of in-memory loaders and encrypted payloads to evade static detection: (‘loaded directly into memory’ and AES encrypted payloads)
• [T1027.002] Obfuscated Files or Information: Software Packing – use of encoded/packed configuration and payload content (base64 + AES keys) to hide parameters and code: (‘first 32 characters of this string serve as the AES decryption key, while the subsequent data contains configuration information’)
• [T1620] Reflective Code Loading – payloads executed in memory without touching disk (memory-only execution of SIGNBT and follow-on tools): (‘newly delivered malware variants predominantly execute in the system’s memory only, without touching the disk.’)
• [T1003.001] OS Credential Dumping: LSASS Memory – actor delivered credential dumping utilities as follow-on, memory-resident tools: (‘the actor has been observed to deliver such tools as LPEClient and credential dumping utilities to the victim machines.’)
• [T1057] Process Discovery – malware collects process lists and can kill or inject into processes via CCList functions: (‘getProcessList, processKill, runFile, runAsUser, injectDll, freeDll’)
• [T1082] System Information Discovery – getInfo gathers system and environment details (hostname, OS, uptime, CPU, locale, time zone, network status): (‘gathers various information about the victim’s computer, such as computer name, product name, OS details, system uptime, CPU information, system locale, time zone, network status…’)
• [T1083] File and Directory Discovery – functionality to list drives and directories (getDriveList, getFileDir) used for reconnaissance: (‘getDriveList, getFileDir, changeFileTime, secDelete…’)
• [T1113] Screen Capture – remote functions include screen capture to collect visual data: (‘startDownload, upFile, selfMemload, scrCapture’)
• [T1071.001] Web Protocols – C2 uses HTTP/HTTPS POSTs with custom parameterization and base64 payloads for command and control: (‘The malware begins communicating with the C2 server by sending a beacon… uses distinctive strings that start with SIGNBT.’)
• [T1132.002] Data Encoding: Standard Encoding (Base64) – base64 used extensively for configuration and C2 payload encoding: (‘Inside this file is a base64-encoded string’ / ‘both the resulting value and the 24-byte key are encoded with base64.’)
• [T1573.001] Encrypted Channel – AES is used to encrypt/decrypt communicated or stored payload/config data between client and C2: (‘The data received from the C2 server is decrypted using AES with a decryption key obtained from a SIGNBTLG HTTP request.’)
• [T1041] Exfiltration Over C2 Channel – the backdoor can send collected data and files back to C2 via its HTTP-based channels: (‘After sending this system-specific information, the malware sends another HTTP request…’)