• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Confucius APT group Targeting Pakistan – Active IOCs
January 23, 2022
Cybersecurity Trends That Will Be Dominating 2022
January 24, 2022

Rewterz Threat Alert – Lazarus APT Group – Active IOCs

January 23, 2022

Severity

High

Analysis Summary

Following samples of Lazarus group aka Guardians of Peace, a state-sponsored North Korean threat actor group targeting financial organizations for their gains have been active again and actively targeting different organizations via phishing emails dropping malicious word documents which enables macro when downloaded and executed. The malicious file suspected of being used as an attachment has the name Salary_Lockheed_Martin_job_opportunities_confidential.doc . Previously these campaigns were specifically crafted to target Russian organizations but now they’ve shifted their tilt towards Asia pacific region.

update-1642889643.png

Impact

  • Information theft and espionage
  • Exposure of sensitive data

Indicators of Compromise

Domain Name

  • markettrendingcenter[.]com

Filename

  • Salary_Lockheed_Martin_job_opportunities_confidential[.]doc

MD5

  • a27a9324d282d920e495832933d486ee
  • 59094cd94c1af3071ad0f08a9e76c611
  • 225eb44d83165371c58532817186a37f

SHA-256

  • 0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1
  • 4ac481a31a2f739b9bac99efde80b2e73f98eed335a68d252387c39991d7f8ae
  • cfb5fe6bb352a664ddab76fd04dd3abb9703a7d59d193eef72e428b8bd2daf6f

SHA-1

  • 0ab8602cee94f36739b6649467ced514301e58fa
  • 3eab607b2a7da49dd11673ec13005a543dd0ace8
  • 0ebbcd74a0f6ed5cf8e165ebcb8c16f0be8e413c

Remediation

  • Always be suspicious about emails sent by unknown senders.
  • Never click on links/attachments sent by unknown senders.
  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.