Tuesday, May 28, 2024

Lazarus APT Group Uses Cross-platform Malware Framework to Launch Attack Against Corporate Entities

Lazarus APT group believed to be run by the North Korean government, the group know to be active since 2009. The group is financially motivated and known for it’s broad & cross-platform targeting.

Researchers observed a new cross-platform malware framework used by the threat actor group to compromise various organizations in Europe and Asia recently.

MATA Malware Framework

The MATA malware framework used by threat actors from April 2018 to infiltrate corporate entities around the world.

The MATA framework consists of several frameworks the process several components such as the loader, orchestrator, and plugins.

The MATA found to be circulated in April 2018, according to Kaspersky’s research, the threat actors expanded their operations by crafting a brand-new malware framework.

The malware framework found to be used in several hacking campaigns, those target organizations operating in different sectors.

With the framework attackers able to target Windows, Linux, and macOS operating systems. Kaspersky found “several victims from our telemetry and figured out the purpose of this malware framework.”

By using MATA attackers can load additional malware, inject DLLs, manipulates files, and creates proxies on the affected network.

The Windows version of MATA is capable of loading 15 plugins at the same time and to covertly communicate with the C2 server hey employs TLS1.2 connections.

The MATA also allows hackers to scan for new targets on macOS and Linux-based machines, the plugin of Linux version and macOS version are identical.

According to Kaspersky telementary, the victims were recorded in the following countries such as Poland, Germany, Turkey, Korea, Japan, and India.

Once the attacker deployed MATA malware and its plugins, they attempted to find the victim’s databases and execute several database queries to acquire customer lists.

Kaspersky can assess that the MATA framework is linked to the Lazarus APT group. The MATA orchestrator uses two unique filenames, c_2910.cls and k_3872.cls, which have only previously been seen in several Manuscrypt variants, including the samples (0137f688436c468d43b3e50878ec1a1f) mentioned in the US-CERT publication.

The hacker group behind this advanced malware framework attack aimed to steal the customer’s database and distribute ransomware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles