LazyScripter

LazyScripter is an advanced persistent threat group active since at least 2018 that primarily targets the airline industry. Its operations rely heavily on publicly available remote access Trojans and scripting-based toolsets, including H-Worm, also known as Houdini, and Koadic. Its country of origin and state sponsorship are not established. The group uses phishing emails, organization impersonation, recruitment-themed lures, and fake software-patch notices to deliver malicious scripts. A July 2021 campaign targeted European entities with emails impersonating the United Nations World Tourism Organization and the International Air Transport Association. Compressed attachments contained obfuscated JavaScript droppers that deployed VBScript-based H-Worm payloads. Other activity used PDF lures linking to password-protected archives containing obfuscated batch scripts. LazyScripter executes malicious code through JavaScript, VBScript, PowerShell, and Windows command scripts, and abuses the Windows MSHTA utility to execute Koadic stagers. It maintains persistence through autorun registry entries, Startup-folder payloads, and scheduled tasks. Defense-evasion techniques include script obfuscation, disguising executables with security-software icons, disabling Microsoft Defender protections and associated services, adding antivirus exclusions, and deleting security-related logs. Its scripts also attempt privilege elevation and disable User Account Control. PowerShell payloads collect host and user identifiers, operating-system details, Active Directory domain membership, administrative status, and running-process information. Collected information is encrypted with AES-CBC before transmission to command-and-control infrastructure. A separate malicious obfuscation-service operator injected an additional njRAT downloader into some scripts used by LazyScripter; that secondary compromise is distinct from LazyScripter's own activity.