Lazarus hits the defense industry with ThreatNeedle

A previously unknown campaign from Lazarus, a highly prolific advanced threat actor active since at least 2009 that has been linked to a number of multifaceted campaigns, has now been identified by Kaspersky researchers. Since early 2020, it has been targeting the defense industry with a custom backdoor dubbed ThreatNeedle- the backdoor moves laterally through infected networks, gathering sensitive information.

Lazarus, one of today’s most prolific threat actors was active since at least 2009, has been involved in large-scale cyber espionage campaigns, ransomware campaigns, and even attacks against the cryptocurrency market. While the past few years they’ve been focusing on financial institutions, at the beginning of 2020, it appears they have added the defense industry to their “portfolio”.

Kaspersky researchers first became aware of this campaign when they were called in to assist with incident response, and they discovered that the organization had fallen victim to a custom backdoor (a type of malware that allows complete remote control over the device). So far, organizations in more than a dozen countries have been affected.

Initial infection occurs through spear phishing; targets receive emails that contain either a malicious Word attachment or a link to one hosted on company servers. Oftentimes, the emails claimed to have urgent updates related to the pandemic and came, supposedly, from a respected medical center.

Once the malicious document is opened, the malware is dropped and proceeds to the next stage of the deployment process. The ThreatNeedle malware used in this campaign belongs to a malware family known as Manuscrypt, which belongs to the Lazarus group and has previously been seen attacking cryptocurrency businesses.

ThreatNeedle, once installed, is able to obtain full control of the victim’s device, meaning it can do everything from manipulating files to executing received commands.

One of the most interesting techniques in this campaign is the group’s ability to steal data from both office IT networks (a network that contains computers with internet access) and a plant’s restricted network (one containing mission-critical assets and computers with highly sensitive data and no internet access).

According to company policy, no information is supposed to be transferred between these two networks. However, administrators could connect to both networks to maintain these systems. Lazarus was able to obtain control of administrator workstations and then set up a malicious gateway to attack the restricted network and to steal and extract confidential data from there.

“Lazarus was perhaps the most active threat actor of 2020, and it doesn’t appear that this will change anytime soon. In fact, already in January of this year, Google’s Threat Analysis Team reported that Lazarus had been seen using this same backdoor to target security researchers. We expect to see more of ThreatNeedle in the future, and we will be keeping an eye out,” comments Seongsu Park, senior security researcher with the Global Research and Analysis Team (GReAT).

“Lazarus is not just highly prolific but highly sophisticated. Not only were they able to overcome network segmentation, but they did extensive research to create highly personalized and effective spear phishing emails and built custom tools to extract the stolen information to a remote server. With industries still dealing with remote work and, thus, still more vulnerable, it’s important organizations take extra security precautions to safeguard against these types of advanced attacks,” adds Vyacheslav Kopeytsev, security expert with Kaspersky ICS CERT.