Lazardoor

Lazardoor is a Windows backdoor associated with the Lazarus Group and observed in targeted intrusions against South Korean organizations, including defense, IT, media, public-sector, and finance-related entities. It has appeared in campaigns that used watering-hole attacks and exploitation of vulnerable South Korean security software products, including INISAFE CrossWeb EX, MagicLine4NX, VestCert, and TCO!Stream, to gain initial access and deliver follow-on payloads.

Operationally, Lazardoor has been used as an early-stage backdoor within broader Lazarus intrusion chains. Reported tradecraft includes deployment through compromised websites that selectively served malicious content to intended victims, use of DLL side-loading with legitimate Windows executables, and execution of additional payloads in memory to reduce visibility. In multiple cases, Lazarus paired legitimate executables with malicious DLLs placed in the same directory so that the malicious component would be loaded under the guise of a trusted process. Related activity also included fileless execution, staged loaders, and process injection.

Campaigns involving Lazardoor were linked to post-compromise activity such as command execution, internal reconnaissance, communication with attacker-controlled infrastructure, and delivery of additional malware families used for credential theft and browser or email data collection. In the same intrusion sets, Lazarus was observed using WMI for remote execution, RDP and SSH for internal access, and malware components that supported lateral movement and persistence. Some related operations also deployed rootkit capabilities and BYOVD techniques to disable security products, indicating that Lazardoor can function as one component in a larger, modular intrusion framework rather than as a standalone implant.

The malware has been detected under both Trojan and Backdoor classifications, but the observed behavior and campaign role support its characterization as a backdoor used for covert access and follow-on payload delivery in espionage-oriented Lazarus operations.