The Lazarus Group and its subsidiaries are running even more hacking campaigns than previously thought. Three separate campaigns linked to North Korea’s most active state-sponsored threat actors have been reported in recent weeks, abusing various zero-days to steal sensitive information from target endpoints and deploy malware to establish persistence.
BleepingComputerreported that the US National Cyber Security Centre (NCSC) and South Korea’s National Intelligence Service (NIS) recently observed Lazarus abusing a zero-day in MagicLine4NX for supply chain attacks. MagicLine4NX is a security authentication software that allows secure logins for company employees.
By leveraging the flaw, the group was able to drop malicious code onto the endpoints of their targets, conducting reconnaissance, data exfiltration, malware drops, lateral network movement, and more.
Funding nukes
Finally, last week Microsoft warned of Lazarus targeting CyberLink, a known multimedia company from Taiwan. The group used this privilege to infect one of CyberLink’s installers with malware, resulting in infections wherever the software was updated.
The companies that grab the infected update will get LambLoad, a malware downloader that doesn’t work on devices protected by FireEye, CrowdStrike, or Tanium, Microsoft added.
If LambLoad spots none of these endpoint protection tools on the device, however, it will drop a fake PNG file that deploys the final payload. This payload can steal sensitive data, infiltrate software build environments, progress downstream, establish persistent access, and more.
Lazarus is mostly interested in corporate espionage, financial fraud, and cryptocurrency theft. In fact, the group was behind one of the largest cryptocurrency heists of all time, when it managed to walk away with more than half a billion dollars in various cryptocurrencies from the Vietnamese Ronin bridge.
Researchers speculate that the money is being used to fund North Korea’s nuclear program.
In a statement, CyberLink told TechRadar Pro, "On 11/22/2023 we identified a malware issue in the installation file for one of our multimedia programs, Promeo. Upon discovery, our dedicated cybersecurity team immediately removed the bug and additional security measures were put in place to prevent this from happening again in the future.
We are committed to maintaining the highest standards of digital security and are taking this matter extremely seriously. Hence, as a precautionary measure, we made the decision to inspect the full lineup of CyberLink products (e.g. PowerDirector, PhotoDirector, PowerDVD) using trusted tools like Microsoft Defender, CrowdStrike, Symantec, TrendMicro, and Sophos software. We can confirm that none of the other programs were affected."
More from TechRadar Pro
- Microsoft claims CyberLink has been breached by North Korean hackers
- Here's a list of the best firewalls around today
- These are the best identity theft protection tools right now
