LAZARUS GROUP SYMANTEC CODE

Its campaign motives have included espionage, data theft, financial gain and disruptive attacks. Lazarus, which has been attributed to the North Korean government by the U.S. “This activity aligns with historical Lazarus intrusions targeting critical infrastructure and energy companies to establish long-term access to siphon off proprietary intellectual property.” “The main goal of these attacks was likely to establish long-term access into victim networks to conduct espionage operations in support of North Korean government objectives,” said Jung soo An, Asheer Malhotra and Vitor Ventura, researchers with Cisco Talos, in a Thursday analysis. The attacks, observed between February and July, leveraged Log4Shell in order to gain an initial foothold in the victims’ networks before deploying several custom malware implants, including VSingle and YamaBot, both of which are exclusively developed and distributed by Lazarus, as well as a previously unknown malware called MagicRat. Given the level of sophistication in the attacks against Bangladesh Bank and others, it has been suggested in the past that those who carried them out could be insiders.The North Korean state-sponsored actor Lazarus Group has been compromising VMware Horizon servers by exploiting the Log4j flaw, in order to target energy companies in the U.S., Canada and Japan. One of its main tenets is better information sharing within the industry, which Swift says it will help co-ordinate. Global bank transfer messaging organization Swift responded this week by launching a five-point plan for its members designed to fortify their defenses against future attacks. “The discovery of more attacks provides further evidence that the group involved is conducting a wide campaign against financial targets in the region.”

The FBI concluded that the North Korean government was responsible for this attack,” explained Symantec. “The group was linked to Backdoor.Destover, a highly destructive trojan that was the subject of an FBI warning after it was used in an attack against Sony Pictures Entertainment. Lazarus is linked to a string of attacks since 2009 aimed at US and South Korean organizations. This raises the prospect that the hackers who attacked Bangladesh Bank and others are North Korean state-sponsored operatives. However, Backdoor.Contopee also provides a link to the Lazarus gang, which has been observed using the same malware. This means that at least one more bank, in the Philippines, is likely to have been attacked by the Swift hackers that have already been pegged for raids on the Bangladesh Bank, Vietnam’s Tien Phong bank and Ecuador’s Banco del Austro.

LAZARUS GROUP SYMANTEC CODE

“Symantec believes distinctive code shared between families and the fact that Backdoor.Contopee was being used in limited targeted attacks against financial institutions in the region, means these tools can be attributed to the same group,” it explained. On closer inspection it discovered code sharing between early variants of Backdoor.Contopee and Trojan.Banswift – which was used in the $81 million heist at the Bangladesh Bank.

The security giant explained in a blog post that it identified three pieces of malware used in a newly discovered set of attacks on South-east Asian banks: Backdoor.Fimlis,, and Backdoor.Contopee.

The recent Swift attacks on banks across the globe have links to the infamous Lazarus Group pegged for the Sony Pictures Entertainment hack, according to Symantec.

Lazarus group symantec