Infamous North Korean threat actor Lazarus Group has been observed engaging in a highly sophisticated, targeted malware attack that involves compromising popular open-source software and running spear phishing campaigns.
As a result, it has managed to compromise “numerous” organizations in the media, defense and aerospace, as well as IT services industries, a report from Microsoft has concluded.
The company claims Lazarus (or ZINC, as it dubs the group) compromised PuTTY, among other open-source applications, with malicious code that installs spyware. PuTTY is a free and open-source terminal emulator, serial console, and network file transfer application.
Installing ZetaNile
But simply compromising open-source software doesn’t guarantee entrance to the target organization’s endpoints - people still need to download and run the software. That’s where spear-phishing comes in. By engaging in a highly-targeted social engineering attack on LinkedIn, the threat actors get certain individuals working at target companies to download and run the app. Apparently, the group’s members assume the identities of recruiters on LinkedIn, offering people lucrative job opportunities.
The app was specifically tailored to avoid being detected. It’s only when the app connects to a specific IP address, and logs in using a special set of login credentials, that the app initiates the ZetaNile espionage malware.
Besides PuTTY, Lazarus managed to compromise KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording.
"The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. "Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions."
Lazarus is no stranger to fake job offer attacks. After all, the group has been doing the same for crypto developers and artists, pretending to be recruiters for the likes of Crypto.com or Coinbase.
- Here are the best firewalls right now
