Infamous North Korean threat actor Lazarus Group has been observed engaging in a highly sophisticated, targeted malware attack that involves compromising popular open-source software and running spear phishing campaigns.
As a result, it has managed to compromise “numerous” organizations in the media, defense and aerospace, as well as IT services industries, a report (opens in new tab) from Microsoft has concluded.
The company claims Lazarus (or ZINC, as it dubs the group) compromised PuTTY, among other open-source applications, with malicious code that installs spyware. PuTTY is a free and open-source terminal emulator, serial console, and network file transfer application.
Installing ZetaNile
But simply compromising open-source software doesn’t guarantee entrance to the target organization’s endpoints – people still need to download and run the software. That’s where spear-phishing comes in. By engaging in a highly-targeted social engineering attack on LinkedIn, the threat actors get certain individuals working at target companies to download and run the app. Apparently, the group’s members assume the identities of recruiters on LinkedIn, offering people lucrative job opportunities.
The app was specifically tailored to avoid being detected. It’s only when the app connects to a specific IP address, and logs in using a special set of login credentials, that the app initiates the ZetaNile espionage malware.
Besides PuTTY, Lazarus managed to compromise KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording.
“The actors have successfully compromised numerous organizations since June 2022,” members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. “Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions.”
Lazarus is no stranger to fake job offer attacks. After all, the group has been doing the same for crypto developers and artists, pretending to be recruiters for the likes of Crypto.com or Coinbase.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba