Thursday, November 30, 2023

Lazarus APT Group Uses Cross-platform Malware Framework to Launch Attack Against Corporate Entities

Lazarus APT group believed to be run by the North Korean government, the group know to be active since 2009. The group is financially motivated and known for it’s broad & cross-platform targeting.

Researchers observed a new cross-platform malware framework used by the threat actor group to compromise various organizations in Europe and Asia recently.

MATA Malware Framework

The MATA malware framework used by threat actors from April 2018 to infiltrate corporate entities around the world.

The MATA framework consists of several frameworks the process several components such as the loader, orchestrator, and plugins.

The MATA found to be circulated in April 2018, according to Kaspersky’s research, the threat actors expanded their operations by crafting a brand-new malware framework.

The malware framework found to be used in several hacking campaigns, those target organizations operating in different sectors.

With the framework attackers able to target Windows, Linux, and macOS operating systems. Kaspersky found “several victims from our telemetry and figured out the purpose of this malware framework.”

By using MATA attackers can load additional malware, inject DLLs, manipulates files, and creates proxies on the affected network.

The Windows version of MATA is capable of loading 15 plugins at the same time and to covertly communicate with the C2 server hey employs TLS1.2 connections.

The MATA also allows hackers to scan for new targets on macOS and Linux-based machines, the plugin of Linux version and macOS version are identical.

According to Kaspersky telementary, the victims were recorded in the following countries such as Poland, Germany, Turkey, Korea, Japan, and India.

Once the attacker deployed MATA malware and its plugins, they attempted to find the victim’s databases and execute several database queries to acquire customer lists.

Kaspersky can assess that the MATA framework is linked to the Lazarus APT group. The MATA orchestrator uses two unique filenames, c_2910.cls and k_3872.cls, which have only previously been seen in several Manuscrypt variants, including the samples (0137f688436c468d43b3e50878ec1a1f) mentioned in the US-CERT publication.

The hacker group behind this advanced malware framework attack aimed to steal the customer’s database and distribute ransomware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

Zyxel Command Injection Flaws Let Attackers Run OS Commands

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products,...

North Korean Hackers Attacking macOS Using Weaponized Documents

Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles