Lazarus hacker Group Attack Defence Industries with custom-made Malware ThreatNeedle

Lazarus has now added the defence industry to its growing list of victims. Lazarus is a North Korean hacking group that has been active since 2009. The group has primarily been linked with ransomware campaigns, cyberespionage, and attacks against the cryptocurrency market. 

Researchers at Kaspersky were made aware of the attack on the defence industry when they had responded to an incident, and had discovered a backdoor that was subsequently named ThreatNeedle. The main goal of the backdoor is to extract confidential information and send it to the attackers by moving laterally through the infected networks.

Spearphishing is the method commonly used to deliver ThreatNeedle to the targets. The malicious Word documents are written to sound like urgent communication and updates regarding COVID-19.

ThreatNeedle is installed upon the document being opened, and this allows the attacker to take control of the infected machine.

Though this sounds like a regular malware that infects your system and steals data, it is nothing like it. It is more a malware on steroids than your run of the mill softwares. ThreatNeedle is capable of jumping between internet-facing office networks and restricted access operational technology (OT) networks where mission-critical hardware lives. 

The policies of the victim companies state that under no circumstance should data be able to be transferred between the two networks. However, administrators had the ability to connect to both solely for the purpose of maintenance.

“Lazarus was able to obtain control of administrator workstations and then set up a malicious gateway to attack the restricted network and to steal and extract confidential data from there. Not only were they able to overcome network segmentation, but they did extensive research to create highly personalized and effective spearphishing emails and built custom tools to extract the stolen information to a remote server. With industries still dealing with remote work and, thus, still more vulnerable, it is important that organizations take extra security precautions to safeguard against these types of advanced attacks,“ Kaspersky said.

Precautions to be taken:

1. Extensive training to the staff regarding cybersecurity hygiene
2. Teach and make the staff aware of the internal policies
3. Segmenting OT networks from IT networks
4. Provide the latest threat intelligence to the security teams
5. Have dedicated OT network security including but not limited to traffic monitoring, analysis, and threat detection.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.