Rewterz Threat Alert – Lazarus – IOC’s

Severity

High

Analysis Summary

Following samples of Lazarus group, an state sponsored threat actor targeting financially organizations for their gains have been active again and actively targeting different organizations via phishing emails dropping malicious word documents which enables macro when downloaded and executed. Previously these campaigns were specifically crafted to target Russian organizations but now they’ve shifted their tilt towards Asia pacific region.

Impact

Credential theft
Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

1fe1fa6b01166c373de68c029d8cdda60cb1599053f935e580f3f40aaf106345
77a32726af6205d27999b9a564dd7b020dc0a8f697a81a8f597b971140e28976
0237b186086fa4d13e8c854dcf2d0f8a19fcbe62a58a415e9a5a933f1154e7d8
5426af0a8bce2fcc61fcf189e6119fe1
57311afff964c7e4fd736ec4c2283566
4a701148a650558d660fb36445461dcd
11cd6b4823058ce8d0fdbc4169508f9e836abb05
3c15414893396f68eb283dda3a470310858f55be
9bd3283af048363d270fceae0bc4292dc50e5309

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
ever click on the links/attachments sent by unknown senders

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo