Windows Update and GitHub were utilized in a campaign by a notorious cybercrime group.
What you need to know
- A new campaign by the North Korean advanced persistent threat group Lazarus was recently discovered.
- The campaign used malicious documents pretending to be about a job for Lockheed Martin as part of spear phishing attacks.
- The Lazarus group also took advantage of Windows Update to bypass security detection mechanisms.
Malwarebytes recently discovered a campaign perpetrated by the advanced persistent threat group (APT) known as Lazarus. The campaign used spear phishing attacks that included malicious documents disguised as information about job opportunities with Lockheed Martin. As part of its attack methodology, the Lazarus group uses Windows Update and GitHub to bypass security software.
Malwarebytes thoroughly breaks down the attack in technical terms. One part of the campaign uses Windows Update to bypass security detection mechanisms. Malwarebytes notes that this is a “clever” use of Windows Update.
“This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms,” said Malwarebytes. “With this method, the threat actor can execute its malicious code through the Microsoft Windows Update client…”
The Lazarus group also used GitHub in its attack. Using GitHub makes it difficult for security products to tell the difference between malicious and legitimate content. This is the first time that Malwarebytes has observed the group using GitHub in this way.
“Rarely do we see malware using GitHub as C2 and this is the first time we’ve observed Lazarus leveraging it,” explained Malwarebytes. “Using GitHub as a C2 has its own drawbacks but it is a clever choice for targeted and short term attacks as it makes it harder for security products to differentiate between legitimate and malicious connections.”
The Lazarus group previously used spear phishing tactics to obtain COVID-19 research. Lazarus was also connected to the well-known attack on Sony and the WannaCry ransomware attack.
Lazarus was also alleged to be involved in the theft of $400 million worth of cryptocurrency in 2021.