LazarShell

LazarShell is a Windows malware family associated with the Lazarus Group and observed in targeted intrusions against South Korean organizations, including defense and chemical-sector entities. It has been used in campaigns that combined watering-hole compromises of legitimate websites with exploitation of vulnerable local security software, notably INITECH INISAFE CrossWeb EX and, in related intrusion chains, DreamSecurity MagicLine4NX.

In documented activity, LazarShell was delivered by abusing a legitimate, signed INITECH process as an execution host. A malicious DLL identified as SCSKAppLink.dll was injected into the INISAFE CrossWeb EX service process and, when running in that context, contacted attacker-controlled infrastructure to download and execute additional malware. The code contained host-process-aware branching logic and was assessed as part of a broader Lazarus toolset that also included downloader, backdoor, loader, keylogging, port-scanning, and rootkit components.

The surrounding intrusion activity indicates LazarShell functioned as part of a multi-stage post-compromise framework. Lazarus operators used compromised websites to selectively target victims, then leveraged vulnerable software components for code execution and malware deployment. Subsequent operations in related cases included internal propagation via WMI and occasional use of RDP or SSH, establishment of persistence through service creation, and defense evasion through rootkit deployment and bring-your-own-vulnerable-driver techniques to disable security products. The malware family is therefore best understood as one element of a larger Lazarus intrusion ecosystem focused on stealthy access, payload delivery, and follow-on compromise inside enterprise Windows environments.