Lazarus Group Continues Targeting Defense Contractors

Lazarus Group Targeting Defense ContractorsNorth Korea’s Lazarus Group has been launching phishing campaigns against more defense contractors and engineering companies, according to researchers at AT&T Alien Labs. The attackers are sending spear phishing emails with malicious documents.

“Several documents identified from May to June 2021 by Twitter users were identified as being linked to the Lazarus group,” the researchers write. “Documents observed in previous campaigns lured victims with job opportunities for Boeing and BAE systems....The documents attempted to impersonate new defense contractors and engineering companies like Airbus, General Motors (GM), and Rheinmetall. All of these documents contain macro malware, which has been developed and improved during the course of this campaign and from one target to another. The core techniques for the three malicious documents are the same, but the attackers attempted to reduce the potential detections and increase the faculties of the macros.”

The titles of the documents include “Rheinmetall_job_requirements.doc,” “General_motors_cars.doc,” and “Airbus_job_opportunity_confidential.doc.”

“The first two documents from early May 2021 were related to a German Engineering company focused on the defense and automotive industries, Rheinmetall,” the researchers write. “The second malicious document appears to include more elaborate content, which may have resulted in the documents going unnoticed by victims.”

The researchers note that this campaign is consistent with earlier Lazarus Group operations.

“The reported activity remains in line with the Lazarus’ past campaigns and is not expected to be the last,” the researchers write. “Attack lures, potentially targeting engineering professionals in government organizations, showcase the importance of tracking Lazarus and their evolution. We continue to see Lazarus using the same tactic, techniques, and procedures that we have observed in the past, such as using Microsoft Office documents that download remote templates, Microsoft Office Macros, and compromised third party infrastructure to host the payloads and proxy C&C traffic through.”

New-school security awareness training can enable your employees to recognize targeted social engineering attacks.

AT&T Alien Labs has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Cybersecurity Awareness Month Free Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews