Threat Actor 🇰🇵 North Korea

Lazarus Group

Also known as: Operation DarkSeoul · Dark Seoul · Hidden Cobra · Hastati Group · Andariel · Unit 121 · Bureau 121 · NewRomanic Cyber Army Team · Bluenoroff · Subgroup: Bluenoroff · Group 77 · Labyrinth Chollima · Operation Troy · Operation GhostSecret · Operation AppleJeus · APT38 · APT 38 · Stardust Chollima · Whois Hacking Team · Zinc · Appleworm · Nickel Academy · APT-C-26 · NICKEL GLADSTONE · COVELLITE · ATK3 · G0032 · ATK117 · G0082 · Citrine Sleet · DEV-0139 · DEV-1222 · Diamond Sleet · ZINC · Sapphire Sleet · COPERNICIUM · TA404 · Lazarus group · BeagleBoyz · Moonstone Sleet · Black Artemis

Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.

Indicators of Compromise 11

Domain us[.]zoom[.]06webin[.]us Filename Temp.b Filename package.bat Filename package.db GitHub User alchemy_john_mac SHA-256 d2a74db6b9c900ad29a81432af72eee8ed4e22bf61055e7e8f7a5f1a33778277 IP 142[.]111[.]77[.]196 Package harthat-api Package harthat-hash Registry User John Registry User nagasiren978

MITRE ATT&CK TTPs 10

T1027
Obfuscated Files or Information
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1085
T1085
 T1134
Access Token Manipulation
Defense Evasion
 T1204.002
Malicious File
Execution
 T1218.011
Rundll32
Defense Evasion
 T1557
Adversary-in-the-Middle
Credential Access
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access

Source Articles

Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access | Datadog Security Labs
Stressed Pungsan, a DPRK-aligned threat actor, has been observed leveraging malicious npm packages for initial access. The actor published two packages, 'harthat-hash' and 'harthat-api', which execute a preinstall script to download and run a malicious DLL from a C2 server. The infrastructure and TTPs align with Microsoft's MOONSTONE SLEET, indicating a focus on Windows environments and potential espionage or credential theft objectives.
Datadog Security Labs
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
North Korean threat actor BlueNoroff is conducting targeted phishing campaigns using typosquatted Zoom and Microsoft Teams domains to deliver the ClickFix malware. The attackers hijack trusted Telegram accounts in the cryptocurrency space to distribute lures, enabling social engineering attacks that profile victims' cryptocurrency wallets before delivering malware. The phishing kit uses AI-generated headshots and real body movements from prior meetings to create convincing fake calls, and operators selectively target high-value individuals by fingerprinting browser wallets. The campaign demonstrates a self-propagating attack chain leveraging compromised identities and infrastructure for sustained operations.
hacker-news ·4d ago