Pierluigi Paganini September 08, 2022

North Korea-linked Lazarus APT group is targeting energy providers around the world, including organizations in the US, Canada, and Japan.

Talos researchers tracked a campaign, orchestrated by North Korea-linked Lazarus APT group, aimed at energy providers around the world, including organizations in the US, Canada, and Japan. The campaign was observed between February and July 2022. 

The attacks aimed at infiltrating organizations around the world for maintaining long-term access and exfiltrate data from the victims.

“Targeted organizations include energy providers from around the world, including those headquartered in the United States, Canada and Japan.” reads the analysis published by Talos. “The campaign is meant to infiltrate organizations around the world for establishing long term access and subsequently exfiltrating data of interest to the adversary’s nation-state.”

The attack chain observed by the experts starts with the exploitation of vulnerabilities (i.e. Log4j vulnerability) in VMWare products to achieve initial footholds into enterprise networks. Once obtained access to the network, threat actors deployed custom implants tracked as VSingle and YamaBot.

VSingle is an HTTP bot that executes arbitrary code from a remote network. It also downloads and executes plugins. The bot was used to carry out a variety of malicious activities, including reconnaissance, malware deployment, and data exfiltration. YamaBot is a backdoor written in Golang.

The nation-state hackers also employed known malware families, along with the previously unknown malware implant called by Talos “MagicRAT.”

“The main goal of these attacks was likely to establish long-term access into victim networks to conduct espionage operations in support of North Korean government objectives.” continues the report.

The same campaign was partially documented by Symantec and AhnLab earlier this April and May.

Cisco Talos experts observed multiple attacks targeting several victims, they also provided details for two of the most representative ones:

• Victim 1: Illustrates the kill chain from exploitation to actions on objectives. This intrusion also illustrates the use of the VSingle implant.
• Victim 2: Represents a kill chain similar to Victim 1 but in this instance, we observed the deployment of a new implant we’re calling “MagicRAT” along with VSingle.

While the infection chain is similar across multiple intrusions in this campaign, there were some key variations that consist of some optional activities conducted by the APT group in different intrusion sets.

Below is the list of variations shared by Talos:

• Credential harvesting using tools such as Mimikatz and Procdump.
• Proxy tools to set up SOCKs proxies.
• Reverse tunneling tools such as PuTTY’s plink.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Lazarus APT)

[adrotate banner=”5″]

[adrotate banner=”13″]