Lazarus

Атакуемые страны

• Австралия
• Бангладеш
• Бразилия
• Великобритания
• Вьетнам
• Гватемала
• Германия
• Гонконг
• Израиль
• Индия
• Индонезия
• Ирак
• Иран
• Канада
• Китай
• Малайзия
• Мексика
• Польша
• Россия
• США
• Саудовская Аравия
• Таиланд
• Тайвань
• Турция
• Филиппины
• Франция
• Чили
• Эквадор
• Южная Корея
• Япония

Отчеты Positive Technologies и других исследователей

• https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/lazarus-recruitment/
• https://blog.trendmicro.com/trendlabs-security-intelligence/wipall-malware-leads-to-gop-warning-in-sony-hack/
• https://unit42.paloaltonetworks.com/tdrop2-attacks-suggest-dark-seoul-attackers-return/
• https://unit42.paloaltonetworks.com/unit42-the-blockbuster-sequel/
• https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group
• https://unit42.paloaltonetworks.com/unit42-blockbuster-saga-continues/
• https://us-cert.cisa.gov/ncas/alerts/TA17-318A
• https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/
• https://securingtomorrow.mcafee.com/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/
• https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html
• https://blogs.360.cn/blog/apt-c-26/
• https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
• https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/
• https://securelist.com/operation-applejeus/87553/
• https://www.virusbulletin.com/blog/2018/11/vb2018-paper-hacking-sony-pictures/
• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-malware-appears-linked-to-lazarus-cybercrime-group/
• https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf
• https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/
• https://www.flashpoint-intel.com/blog/collective-intelligence-podcast-vitali-kremez-on-redbanc-attack-and-lazarus-group/
• https://blog.talosintelligence.com/2019/01/fake-korean-job-posting.html
• https://research.checkpoint.com/2019/north-korea-turns-against-russian-targets/
• https://blog.malwarebytes.com/threat-analysis/2019/03/the-advanced-persistent-threat-files-lazarus-group/
• https://www.us-cert.gov/ncas/analysis-reports/AR19-100A
• https://www.sentinelone.com/blog/lazarus-apt-targets-mac-users-poisoned-word-document/
• https://labs.sentinelone.com/lazarus-apt-targets-mac-users-poisoned-word-document/
• https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf
• https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
• https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
• https://www.us-cert.gov/ncas/analysis-reports/ar19-252a
• https://www.us-cert.gov/ncas/analysis-reports/ar19-252b
• https://www.fortinet.com/blog/threat-research/deep-analysis-nukesped-rat.html
• https://www.trendmicro.com/en_us/research/19/k/mac-backdoor-linked-to-lazarus-targets-korean-users.html
• https://labs.sentinelone.com/the-deadly-planeswalker-how-the-trickbot-group-united-high-tech-crimeware-apt/
• https://us-cert.cisa.gov/ncas/current-activity/2020/02/14/north-korean-malicious-cyber-activity
• https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/
• https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/
• https://www.us-cert.gov/ncas/analysis-reports/ar20-133b
• https://blog.malwarelab.pl/posts/lazarus_validator/
• https://www.welivesecurity.com/2020/06/17/operation-interception-aerospace-military-companies-cyberspies/
• https://blog.reversinglabs.com/blog/hidden-cobra
• https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/
• https://blog.reversinglabs.com/events/hunting-for-nation-state-attacks
• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/
• https://www.clearskysec.com/operation-dream-job/
• https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a
• https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical
• https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic/
• https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic-part-two/
• https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/
• https://www.hvs-consulting.de/lazarus-report/
• https://www.sentinelone.com/blog/12-months-of-fighting-cybercrime-sentinellabs-2020-review/
• https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
• https://us-cert.cisa.gov/ncas/alerts/aa21-048a
• https://securelist.ru/lazarus-threatneedle/100591/
• https://0xthreatintel.medium.com/internals-of-lazarus-operation-dream-job-7ced9fc7da3e
• https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/
• https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/