Lazarus Group

OriginCoreia do Norte

Techniques (MITRE ATT&CK)93

SourceMITRE ATT&CK

Also known as:Labyrinth ChollimaHIDDEN COBRAGuardians of PeaceZINCNICKEL ACADEMYDiamond Sleet

Vexday analysis

Lazarus Group é um grupo de ameaça persistente avançada (APT) patrocinado pelo Estado norte-coreano e atribuído ao Reconnaissance General Bureau (RGB), ativo pelo menos desde 2009. O grupo, rastreado pela MITRE ATT&CK sob o identificador G0032 e também conhecido pelos aliases Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY e Diamond Sleet, é apontado como responsável pelo ataque destrutivo de novembro de 2014 contra a Sony Pictures Entertainment, identificado pela Novetta como parte da Operação Blockbuster. Malwares associados ao grupo foram correlacionados a outras campanhas documentadas, incluindo Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul e Ten Days of Rain. Ao todo, 93 técnicas MITRE ATT&CK foram documentadas em suas operações, além de uma CVE atribuída ao grupo.

Techniques (MITRE ATT&CK) 93

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Gather Victim Org Information

Resource development

Domains Web Services Server Social Media Accounts Email Accounts Malware Tool Digital Certificates

Initial access

Drive-by Compromise Spearphishing Attachment Spearphishing Link Spearphishing via Service

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Visual Basic Native API Exploitation for Client Execution Malicious File

Persistence

Account Manipulation Windows Service Registry Run Keys / Startup Folder Shortcut Modification

Credential access

Password Spraying Name Resolution Poisoning and SMB Relay

Discovery

Application Window Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Local Storage Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares SSH

Collection

Data from Local System Keylogging Local Data Staging Archive Collected Data Archive via Library Archive via Custom Method

Command and control

Protocol or Service Impersonation Fallback Channels Web Protocols Internal Proxy External Proxy Bidirectional Communication Multi-Stage Channels Ingress Tool Transfer Standard Encoding Non-Standard Port Symmetric Cryptography

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Unencrypted Non-C2 Protocol

Impact

Data Destruction Service Stop Internal Defacement System Shutdown/Reboot Disk Content Wipe Disk Structure Wipe

defense-impairment

Code Signing Disable or Modify Tools Windows Host Firewall

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2018-4878HIGHEPSS 90%KEV

Lazarus Group uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →