Malwarebytes recently discovered a campaign perpetrated by the advanced persistent threat group (APT) known as Lazarus. The campaign used spear phishing attacks that included malicious documents disguised as information about job opportunities with Lockheed Martin. As part of its attack methodology, the Lazarus group uses Windows Update and GitHub to bypass security software.
Malwarebytes thoroughly breaks down the attack in technical terms. One part of the campaign uses Windows Update to bypass security detection mechanisms. Malwarebytes notes that this is a “clever” use of Windows Update.
“This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms,” said Malwarebytes. “With this method, the threat actor can execute its malicious code through the Microsoft Windows Update client…”
The Lazarus group also used GitHub in its attack. Using GitHub makes it difficult for security products to tell the difference between malicious and legitimate content. This is the first time that Malwarebytes has observed the group using GitHub in this way.
“Rarely do we see malware using GitHub as C2 and this is the first time we’ve observed Lazarus leveraging it,” explained Malwarebytes. “Using GitHub as a C2 has its own drawbacks but it is a clever choice for targeted and short term attacks as it makes it harder for security products to differentiate between legitimate and malicious connections.”
The Lazarus group previously used spear phishing tactics to obtain COVID-19 research. Lazarus was also connected to the well-known attack on Sony and the WannaCry ransomware attack.
Lazarus was also alleged to be involved in the theft of $400 million worth of cryptocurrency in 2021.
These laptops have bright screens great for outdoor use
Due to the never-ending war against sun glare, laptop developers have made their laptop screens brighter than ever in recent years. Here’s a collection of some of our favorite laptops with bright displays.
