LazarLoader

LazarLoader is a Windows malware family associated with the Lazarus Group and used as part of multi-stage intrusion chains against organizations in South Korea. It has been observed in campaigns targeting sectors including defense, chemical, IT, media, public institutions, and finance, often alongside other Lazarus tooling such as Lazardoor, LazarAgent, and credential-stealing components. The malware has been linked to exploitation of vulnerable South Korean security software and to execution through trusted Windows processes and DLL side-loading chains.

LazarLoader functions primarily as a staged loader or downloader that retrieves and launches additional payloads. Reported variants and related components have been used to download follow-on malware, decrypt embedded payloads in memory, and execute them within legitimate processes. In some observed chains, LazarLoader-related DLLs were injected into legitimate software components or side-loaded through signed or benign executables, including abuse of Windows binaries to blend malicious execution with normal system activity. A related side-loading implementation used a malicious DLL containing an AES-128-encrypted embedded binary that was decrypted at runtime and executed in memory.

Delivery has been tied to watering-hole operations exploiting vulnerabilities in software widely deployed in South Korean environments, including INISAFE CrossWeb EX, MagicLine4NX, VestCert, and TCO!Stream. In these campaigns, compromised websites selectively served exploit content to intended victims, after which Lazarus malware was downloaded and executed. LazarLoader has also appeared in intrusion sets that relied on DLL side-loading after initial compromise, enabling stealthy execution and staging of additional malware.

Observed tradecraft around LazarLoader and closely related Lazarus tooling includes process injection, in-memory execution, defense evasion through use of legitimate host processes, and internal reconnaissance or follow-on deployment of credential theft and backdoor capabilities by companion malware. Technical overlaps noted by defenders include custom decryption logic and NTDLL unhooking behavior seen in later malware assessed as sharing characteristics with LazarLoader. Overall, LazarLoader is best understood as a Lazarus-associated Windows loader used to establish execution of subsequent payloads during targeted espionage-oriented intrusions.