- These Lazarus campaigns targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium.
- The campaigns used malicious Amazon-themed documents, and the primary goal was data exfiltration.
- A tool used in this campaign presents the first recorded abuse of the CVE-2021-21551 vulnerability. This vulnerability affects Dell DBUtil drivers; Dell provided a security update in May 2021.
- This tool, in combination with the vulnerability, disables the monitoring of all security solutions on compromised machines. The existence of such a tool should be a warning to developers of security products to improve the self-protection of their software.
- The complexity of the attack indicates that Lazarus consists of a large team that is systematically organized and excellently prepared.
BRATISLAVA, PRAGUE, September 30, 2022 — ESET researchers uncovered and analyzed a set of malicious tools that were used by the infamous Lazarus APT group in attacks during the end of 2021. The campaign started with spear phishing emails containing malicious Amazon-themed documents, and it targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium. The primary goal of the attackers was data exfiltration.
Both victims were presented with job offers: The employee in the Netherlands received an attachment via LinkedIn Messaging, and the journalist in Belgium received a document via email. The attacks started after these documents were opened. The attackers deployed several malicious tools on the system, including droppers, loaders, fully featured HTTP(S) backdoors, and HTTP(S) uploaders.
The most notable tool delivered by the attackers was a user-mode module that gained the ability to read and write kernel memory due to the CVE-2021-21551 vulnerability in a legitimate Dell driver. This vulnerability affects Dell DBUtil drivers; Dell provided a security update in May 2021. This is the first ever recorded abuse of this vulnerability in the wild.
“The attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing, etc., basically blinding security solutions in a very generic and robust way,” explains ESET researcher Peter Kálnai, who discovered the campaign. “It was not just done in kernel space, but also in a robust way, using a series of little- or undocumented Windows internals. Undoubtedly this required deep research, development, and testing skills,” he adds.
Lazarus also used a fully featured HTTP(S) backdoor known as BLINDINGCAN. ESET believes this remote access trojan (RAT) has a complex server-side controller with a user-friendly interface through which the operator can control and explore compromised systems.
In the Netherlands, the attack affected a Windows 10 computer connected to the corporate network, where an employee was contacted via LinkedIn Messaging about a potential new job, resulting in an email with a document attachment being sent. The Word file Amzon_Netherlands.docx sent to the victim is merely an outline document with an Amazon logo. ESET researchers were unable to acquire the remote template, but they assume that it may have contained a job offer for the Amazon space program Project Kuiper. This is a method that Lazarus practiced in the Operation In(ter)ception and Operation DreamJob campaigns targeting aerospace and defense industries.
Based on the number of command codes that are available to the operator, it is likely that a server-side controller is available where the operator can control and explore compromised systems. The more than two dozen commands available include downloading, uploading, rewriting, and deleting files, and taking screenshots.
“In this attack, as well as in many others attributed to Lazarus, we saw that many tools were distributed even on a single targeted endpoint in a network of interest. Without a doubt, the team behind the attack is quite large, systematically organized, and excellently prepared,” says Kálnai.
ESET Research attributes these attacks to Lazarus with high confidence. The diversity, number, and eccentricity in implementation of Lazarus campaigns define this group, as well as that it performs all three pillars of cybercriminal activities: cyberespionage, cybersabotage, and pursuit of financial gain. Lazarus (also known as HIDDEN COBRA) has been active since at least 2009. It is responsible for several high-profile incidents.
This research is presented at this year’s Virus Bulletin conference. Detailed information is available in the whitepaper “Lazarus & BYOVD: Evil to the Windows core.”
For more technical information about the latest Lazarus attack, check out the blog post “Amazon-themed campaigns of Lazarus in the Netherlands and Belgium” on WeLiveSecurity.
Make sure to follow ESET Research on Twitter for the latest news from ESET Research.
About ESET
For more than 30 years, ESET® has been developing industry-leading IT security software and services to protect businesses, critical infrastructure, and consumers worldwide from increasingly sophisticated digital threats. From endpoint and mobile security to endpoint detection and response, as well as encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively protect and monitor 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company that enables the safe use of technology. This is backed by ESET’s R&D centers worldwide, working in support of our shared future. For more information, visit www.eset.com or follow us on LinkedIn, Facebook, and Twitter.