Understanding the Lazarus Group
AttackIQ has released a new Flex package designed to replicate the activities associated with the recent supply chain attack on 3CX software by Lazarus Group, a North Korean-based adversary. This package aims to emulate the initial stages of system compromise and hands-on keyboard activity observed during the attack. The attack on 3CX involved a compromised binary, a VoIP phone system, and resulted in various malicious activities, including DLL sideloading, reflective DLL injection, and DLL search order hijacking.
AttackIQ’s Flex package helps security teams evaluate their defense against such threats, assess their security posture against sophisticated adversaries like Lazarus Group, and continually validate detection and prevention pipelines. Detection and mitigation recommendations are provided for specific attack techniques, including DLL sideloading, reflective DLL injection, and DLL search order hijacking, to enhance security.
To gain a deeper understanding of Lazarus Group’s modus operandi, it’s crucial to analyze some of their most notorious attacks. These attacks provide insights into the group’s evolving strategies and techniques, helping organizations prepare against future threats.
Analyzing Their Most Recent Attacks
Atomic Wallet Heist – June 3, 2023
On June 3, 2023, a dark cloud descended upon the users of Atomic Wallet, a non-custodial decentralized cryptocurrency wallet. Over $100 million disappeared from user accounts in what was later attributed to Lazarus Group. According to cyber security firm Elliptic, evidence pointed to a North Korean threat group on June 6, 2023, after identifying multiple telltale signs of their involvement. The FBI later confirmed this attribution, shedding light on the audacious heist.
CoinsPaid’s Costly Social Engineering – July 22, 2023
July 22, 2023, marked a dark day for the crypto payment platform CoinsPaid when Lazarus Group executed a successful social engineering attack. This breach granted the attackers access to the platform’s hot wallets, from which they executed authorized requests to withdraw a staggering $37.3 million in crypto assets. CoinsPaid swiftly pointed fingers at Lazarus for this breach on July 26, a claim later corroborated by the FBI.
Alphapo’s Compromised Crypto – July 22, 2023
On the same day, July 22, 2023, Lazarus Group struck again, this time targeting centralized crypto payment provider Alphapo. The group managed to siphon off a substantial $60 million in crypto assets, possibly leveraging previously compromised private keys. As with previous attacks, the FBI eventually traced the origins of this theft back to Lazarus Group.
Stake.com’s Cryptocurrency Casino Caper – September 4, 2023
September 4, 2023, saw the online cryptocurrency casino Stake.com fall victim to a ruthless attack, resulting in the loss of approximately $41 million in virtual currency. This heist may have been facilitated by a stolen private key. The FBI, in a press release on September 6, officially pointed the finger at Lazarus Group, underlining the group’s relentless pursuit of financial gain.
CoinEx’s Costly Compromise – September 12, 2023
September 12, 2023, marked yet another dark chapter in the world of cryptocurrency when centralized exchange CoinEx suffered a devastating hack, resulting in the theft of $54 million. All signs pointed to Lazarus Group’s involvement in this audacious attack. The incident highlighted the group’s ability to adapt and strike with alarming precision.
Defending Against the Elite
Are Your Defenses Up to Par?
Before delving deeper into cybersecurity defense mechanisms, it’s crucial to assess your organization’s readiness. Do you have the tools and strategies in place to protect against evolving threats?
Meet AttackIQ Flex
Now you can test your defenses against this elusive attacker with AttackIQ’s recently released emulation package for Lazarus group. Users get full access to this attacker TTPs with a single package that can deploy in minutes! No need for a skilled red team – Flex enables even the most novice security team to assess their security controls without the need for painstaking configuration and planning. Best of all, it gives you actionable mitigation recommendations so you can implement proactive mitigations quickly.
Give it a try! How does your security stack up against this attacker group?
In a world where cyber threats proliferate, organizations must remain vigilant. Lazarus Group’s relentless attacks demand proactive measures. With AttackIQ Flex as your ally, your organization can bolster its cybersecurity defenses and face the challenges of the digital age with confidence.
