Loading story…
Employees at Ashot Ashkelon Industries Limited, a subsidiary of Israel Military Industries, were targeted in a spear-phishing campaign that used a Hebrew-language lure posing as a SysAid software update. The email carried a malicious archive, SysAid-Documentation.rar, which exploited the WinRAR ACE path traversal flaw CVE-2018-20250 to place malware in the Windows Startup folder and gain persistence. Researchers linked the operation to a Lazarus-associated cluster and said the primary payload, ekrnview.exe, gathered host information and sent it to hardcoded command-and-control servers through HTTP POST fields including alive, name, key, page, and session_data.
The investigation also uncovered attacker infrastructure and related samples suggesting broader Middle East targeting. One exposed command-and-control server hosted a B374k webshell, while shortcut and working-directory artifacts pointed to tailored targeting and operator development traces such as the usernames john and Albany. Separate samples tied to the same CVE-2018-20250 exploitation chain dropped a fake Telegram Desktop.exe and a Base64-encoded .NET payload, overlapping with activity tracked by 360 as APT-C-27 (Goldmouse) and indicating a wider campaign using WinRAR exploit lures against regional defense-related targets.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Haaretz reported on March 26, 2019 that a North Korea-linked Lazarus cyberattack targeting an Israeli company had been detected. The reporting brought public attention to the intrusion against Ashot Ashkelon Industries Limited.
A related 32-bit .NET payload named "Telegram Desktop.exe" tied to similar ACE-exploit activity was built on March 11, 2019. The sample contained a PDB path referencing the username "Albany" and was associated with Middle East-targeting activity linked by ti.360.net to APT-C-27 (Goldmouse).
A second malicious file named "SysAid-Documentation.rar" was uploaded to VirusTotal from Israel on March 10, 2019. It matched the first sample except for different targeted Windows usernames in the Startup path, including "idans" and "ronpe."
On March 7, 2019, attackers sent a Hebrew-language spear-phishing email to an employee of Ashot Ashkelon Industries Limited, impersonating a SysAid software update. The attached file, "SysAid-Documentation.rar," exploited CVE-2018-20250 to drop "ekrnview.exe" into the Windows Startup path for persistence.
The malicious 64-bit Windows payload "ekrnview.exe" used in the campaign was compiled on February 26, 2019 at 04:37 KST. It was later configured to be dropped into the victim's Windows Startup folder via the WinRAR ACE exploit.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information. Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 15, 2026
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026