Kaspersky researchers have identified a new, previously unknown, campaign from Lazarus, a highly prolific advanced threat actor active since at least 2009 that has been linked to a number of multifaceted campaigns. Since early 2020, the group has been targeting the defense industry with a custom backdoor dubbed ThreatNeedle that moves laterally through infected networks gathering sensitive information.
 Lazarus is one of today’s most prolific threat actors. Active since at least 2009, Lazarus has been involved in large-scale cyberespionage campaigns, ransomware campaigns, and even attacks against the cryptocurrency market. While they have spent recent years focusing on financial institutions, at the beginning of 2020, it appears they have added the defense industry to their portfolio.
Kaspersky researchers first became aware of this campaign when they were called in to assist with incident response and they discovered that the organization had fallen victim to a custom backdoor (a type of malware that allows complete remote control over the device). Coined ThreatNeedle, this backdoor moves laterally through infected networks and extracts confidential information. So far, organizations in more than a dozen countries have been affected.
ThreatNeedle’s initial infection occurs through spear phishing in which targets receive emails that contain either a malicious Word attachment or a link to one hosted on company servers. Often times, the emails claimed to have urgent updates related to the pandemic and supposedly came from a respected medical center.
Once the malicious document is opened, the malware is dropped and proceeds to the next stage of the deployment process. The ThreatNeedle malware used in this campaign belongs to a malware family known as Manuscrypt, which belongs to the Lazarus group and has previously been seen attacking cryptocurrency businesses. Once installed, ThreatNeedle is able to obtain full control of the victim’s device, meaning it can do everything from manipulating files to executing received commands.
One of the most interesting techniques in this campaign is the group’s ability to steal data from both office IT networks (a network that contains computers with internet access) and a plant’s restricted network (one containing mission-critical assets and computers with highly sensitive data and no internet access). According to company policy, no information is supposed to be transferred between these two networks. However, administrators could connect to both networks to maintain these systems. Lazarus was able to obtain control of administrator workstations and then set up a malicious gateway to attack the restricted network and to steal and extract confidential data from there.
To protect your organizations from attacks like ThreatNeedle, Kaspersky experts recommend:
- Provide your staff with basic cybersecurity hygiene training, as many targeted attacks start with phishing or other social engineering techniques.
- If an enterprise has operational technology (OT) or critical infrastructure, make sure it is separated from a corporate network or that there are no unauthorized connections.
- Ensure that employees are aware of and follow cybersecurity policies.
- Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single point of access for the company’s TI, providing cyberattack data and insights gathered by Kaspersky for more than 20 years.
- Implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform.
- It is also recommended to implement a dedicated solution for industrial nodes and networks that enables OT network traffic monitoring, analysis and threat detection – such as Kaspersky Industrial CyberSecurity.
- Source: Kaspersky
