Lazarus Group Targeting Microsoft Web Servers to Launch Espionage Malware

North Korea threat actor Lazarus team is targeting Windows IIS web servers to start espionage attacks, according to a new evaluation by AhnLab Security Crisis reaction Middle (ASEC).

The researchers claimed the approach represents a variation on the dynamic-connection library (DLL) aspect-loading approach, a tactic frequently used by the point out-affiliated team.

Here, they imagine the attackers use “poorly managed or vulnerable web servers as their original breach routes before executing their malicious commands later.”

ASEC spelled out: “The menace actor locations a destructive DLL (msvcr100.dll) in the very same folder route as a usual application (Wordconv.exe) via the Windows IIS web server course of action, w3wp.exe. They then execute the ordinary software to initiate the execution of the malicious DLL. In MITRE ATT&CK, this system of attack is categorized as the DLL facet-loading (T1574.002) approach.”

Subsequent original infiltration, Lazarus build a foothold right before producing further malware (diagn.dll) by exploiting the open up-supply ‘color picker plugin,’ which is a plugin for Notepad++. This malware facilitates credential theft and lateral movement, suitable for carrying out espionage operations.

Past year, Microsoft printed an advisory warning that North Korea-involved threat actors weaponizing legit open-source computer software focusing on staff in businesses across multiple industries.

ASEC highlighted the escalating sophistication of Lazarus group, and its abilities to benefit from a vary of attack vectors to carry out their preliminary breach. These have been shown in incidents like Log4Shell, general public certification vulnerability and the 3CX source chain attack.

The researchers warned: “[Lazarus]is a single of the hugely unsafe groups that are actively launching attacks throughout the world. Thus, corporate security professionals should really make use of attack floor management to detect the property that could be uncovered to threat actors and practice warning by making use of the newest security patches every time doable.”

They included that owing to Lazarus’ concentration on the DLL facet-loading system throughout preliminary infiltrations, “companies should really proactively check abnormal method execution associations and just take preemptive actions to reduce the risk group from carrying out things to do this sort of as info exfiltration and lateral movement.”

This week (May well 23, 2023), the US govt declared sanctions on 3 entities since of their url with North Korea’s principal intelligence company, the Reconnaissance Typical Bureau (RGB), which US officials say is at the rear of several of the country’s cyber espionage and cyber theft things to do.

Some components of this post are sourced from:
www.infosecurity-journal.com