Rewterz Threat Alert – Lazarus APT Group

Rewterz Threat Alert – Confucius APT group Targeting Pakistan – Active IOCs

January 23, 2022

Cybersecurity Trends That Will Be Dominating 2022

January 24, 2022

Rewterz Threat Alert – Lazarus APT Group – Active IOCs

Severity

High

Analysis Summary

Following samples of Lazarus group aka Guardians of Peace, a state-sponsored North Korean threat actor group targeting financial organizations for their gains have been active again and actively targeting different organizations via phishing emails dropping malicious word documents which enables macro when downloaded and executed. The malicious file suspected of being used as an attachment has the name Salary_Lockheed_Martin_job_opportunities_confidential.doc . Previously these campaigns were specifically crafted to target Russian organizations but now they’ve shifted their tilt towards Asia pacific region.

Impact

Information theft and espionage
Exposure of sensitive data

Indicators of Compromise

Domain Name

markettrendingcenter[.]com

Filename

Salary_Lockheed_Martin_job_opportunities_confidential[.]doc

MD5

a27a9324d282d920e495832933d486ee
59094cd94c1af3071ad0f08a9e76c611
225eb44d83165371c58532817186a37f

SHA-256

0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1
4ac481a31a2f739b9bac99efde80b2e73f98eed335a68d252387c39991d7f8ae
cfb5fe6bb352a664ddab76fd04dd3abb9703a7d59d193eef72e428b8bd2daf6f

SHA-1

0ab8602cee94f36739b6649467ced514301e58fa
3eab607b2a7da49dd11673ec13005a543dd0ace8
0ebbcd74a0f6ed5cf8e165ebcb8c16f0be8e413c

Remediation

Always be suspicious about emails sent by unknown senders.
Never click on links/attachments sent by unknown senders.
Block all threat indicators at your respective controls.
Search for IOCs in your environment.