Lazarus Group
Operation DarkSeoulDark SeoulHidden CobraHastati GroupAndarielUnit 121Bureau 121NewRomanic Cyber Army TeamBluenoroffSubgroup: BluenoroffGroup 77Labyrinth ChollimaOperation TroyOperation GhostSecretOperation AppleJeusAPT38
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote… Fuente: MISP
País atribuido: KP según MISP
Actividad en Jábega · 12 semanas
1 noticias · vista por primera vez el 27 oct 2026 · la última, el 27 oct 2026
Noticias
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum EncryptionThe Hacker News · 27 oct 2026
Técnicas MITRE ATT&CK
Reconocimiento
Preparación de recursos
T1583.001DomainsT1583.006Web ServicesT1584.004ServerT1585.001Social Media AccountsT1585.002Email AccountsT1587.001Malware 10 reglas SigmaT1588.002Tool 7 reglas SigmaT1588.004Digital Certificates
Acceso inicial
T1078Valid Accounts 82 reglas SigmaT1189Drive-by Compromise 3 reglas SigmaT1566.001Spearphishing Attachment 21 reglas SigmaT1566.002Spearphishing Link 3 reglas SigmaT1566.003Spearphishing via Service
Ejecución
T1047Windows Management Instrumentation 40 reglas SigmaT1053.005Scheduled Task 40 reglas SigmaT1059.001PowerShell 40 reglas SigmaT1059.003Windows Command Shell 40 reglas SigmaT1059.005Visual Basic 28 reglas SigmaT1106Native API 12 reglas SigmaT1203Exploitation for Client Execution 31 reglas SigmaT1204.002Malicious File 32 reglas SigmaT1574.001DLL 40 reglas SigmaT1574.013KernelCallbackTable
Persistencia
T1098Account Manipulation 36 reglas SigmaT1542.003Bootkit 1 reglas SigmaT1543.003Windows Service 40 reglas SigmaT1547.001Registry Run Keys / Startup Folder 38 reglas SigmaT1547.009Shortcut Modification 4 reglas Sigma
Escalada de privilegios
T1055.001Dynamic-link Library Injection 7 reglas SigmaT1134.002Create Process with Token 7 reglas Sigma
Acceso a credenciales
T1056.001Keylogging 3 reglas SigmaT1110.003Password SprayingT1557.001Name Resolution Poisoning and SMB Relay 10 reglas Sigma
Descubrimiento
T1010Application Window Discovery 1 reglas SigmaT1012Query Registry 11 reglas SigmaT1016System Network Configuration Discovery 4 reglas SigmaT1033System Owner/User Discovery 26 reglas SigmaT1046Network Service Discovery 17 reglas SigmaT1049System Network Connections Discovery 2 reglas SigmaT1057Process Discovery 3 reglas SigmaT1082System Information Discovery 18 reglas SigmaT1083File and Directory Discovery 17 reglas SigmaT1124System Time Discovery 1 reglas SigmaT1680Local Storage Discovery
Movimiento lateral
T1021.001Remote Desktop Protocol 16 reglas SigmaT1021.002SMB/Windows Admin Shares 35 reglas SigmaT1021.004SSH 5 reglas Sigma
Recopilación
T1005Data from Local System 12 reglas SigmaT1074.001Local Data Staging 4 reglas SigmaT1560Archive Collected Data 11 reglas SigmaT1560.002Archive via LibraryT1560.003Archive via Custom Method
Mando y control
T1001.003Protocol or Service Impersonation 2 reglas SigmaT1008Fallback Channels 4 reglas SigmaT1071.001Web Protocols 39 reglas SigmaT1090.001Internal Proxy 6 reglas SigmaT1090.002External Proxy 2 reglas SigmaT1102.002Bidirectional Communication 3 reglas SigmaT1104Multi-Stage ChannelsT1105Ingress Tool Transfer 40 reglas SigmaT1132.001Standard Encoding 4 reglas SigmaT1571Non-Standard Port 5 reglas SigmaT1573.001Symmetric Cryptography
Exfiltración
T1041Exfiltration Over C2 Channel 4 reglas SigmaT1048.003Exfiltration Over Unencrypted Non-C2 Protocol 7 reglas Sigma
Impacto
T1485Data Destruction 15 reglas SigmaT1489Service Stop 13 reglas SigmaT1491.001Internal Defacement 3 reglas SigmaT1529System Shutdown/Reboot 6 reglas SigmaT1561.001Disk Content Wipe 1 reglas SigmaT1561.002Disk Structure Wipe 1 reglas Sigma
Stealth
T1027.007Dynamic API ResolutionT1027.009Embedded Payloads 1 reglas SigmaT1027.013Encrypted/Encoded FileT1036.003Rename Legitimate Utilities 25 reglas SigmaT1036.004Masquerade Task or Service 3 reglas SigmaT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1070Indicator Removal 42 reglas SigmaT1070.003Clear Command History 9 reglas SigmaT1070.004File Deletion 9 reglas SigmaT1070.006Timestomp 4 reglas SigmaT1140Deobfuscate/Decode Files or Information 17 reglas SigmaT1202Indirect Command Execution 38 reglas SigmaT1218System Binary Proxy Execution 137 reglas SigmaT1218.005Mshta 8 reglas SigmaT1218.011Rundll32 40 reglas SigmaT1564.001Hidden Files and Directories 7 reglas SigmaT1620Reflective Code Loading 3 reglas Sigma
Defense impairment
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗