Loading story…
Researchers linked the North Korean Lazarus Group to a long-running malware lineage built around the Volgmer backdoor and the newer Scout downloader, showing how the actor evolved tooling while maintaining overlapping tradecraft. Volgmer was used from at least 2014 into roughly 2021, commonly installed as a service DLL with encrypted configuration data stored in the Windows registry under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. It supported broad espionage functions including file manipulation, reverse shell access, timestomping, anti-forensic deletion, and HTTP/HTTPS command-and-control, and was deployed against Korean organizations across defense, manufacturing, ICT, finance, satellite, software, and media sectors.
Around 2022, Lazarus appears to have shifted toward Scout, a downloader that reused parts of Volgmer’s configuration-loading logic and C2 design but emphasized in-memory payload delivery and execution. Analysts reported shared droppers, registry-based persistence, RC4-encrypted configuration storage, and continued version changes, with Scout v2 adding message-based command handling, configuration updates, self-deletion, and payload injection. Separate reporting also tied North Korean operators to the compromise of a sanctioned Russian missile engineering company, reinforcing the group’s continued focus on strategic intelligence collection and intrusion activity against high-value government and industrial targets.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
ASEC observed Lazarus using the Scout downloader from around 2022 instead of Volgmer. Scout reused parts of Volgmer’s configuration-loading and C2 design but focused on downloading and executing payloads in memory.
A later Volgmer version began appearing in 2017, according to ASEC. This variant continued storing encrypted configuration data in the WMI\Security registry area and used evolving HTTP-based traffic to HTTPS C2 addresses.
ASEC reported that the Lazarus threat group had used the Volgmer backdoor since at least 2014. Volgmer was deployed against Korean and other targets and functioned as a service-based backdoor with registry-stored encrypted configuration data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcesentinelone.com
Open sourcesymantec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026
Researchers linked a targeted malware campaign to the **Lazarus Group** after attackers distributed malicious Microsoft Word files masquerading as Korean job postings, including a fake Cisco Korea systems engineer listing. The lure documents, including **"Job Description.doc"** and **"Job Descriptions.doc"**, used heavily obfuscated VBA macros that required victims to enable macros before dropping a PE32 payload named **`jusched.exe`**, disguised as **Java Update Scheduler**, into **`%APPDATA%\Roaming`**. The documents also displayed a decoy job description to reduce suspicion while the malware executed in the background. Analysis from ESRC and Cisco Talos found the malware used an **XOR `0xE7`** decryption routine, similar macro obfuscation, and reused command construction techniques previously seen in earlier Lazarus operations. The payload attempted to contact compromised legitimate websites over HTTP, including **`secuvision.co.kr`**, to retrieve follow-on commands or second-stage malware. Investigators tied the activity to prior Lazarus campaigns such as **Operation Arabian Night**, **Coin Manager**, and related 2017 job-themed intrusions, indicating a sustained pattern of using employment lures and compromised websites to gain initial access to targeted organizations.
Aug 15, 2026
Researchers reported multiple **DPRK-linked intrusion campaigns** tied to **Lazarus** and **Kimsuky**, highlighting new malware, refreshed delivery chains, and reusable infrastructure. Gen Digital identified Kimsuky using a new `HttpTroy` backdoor against a South Korean target via a fake VPN invoice ZIP and `.scr` dropper, while Lazarus targeted victims in Canada with an updated chain that used a new `Comebacker` variant to memory-load a new `BLINDINGCAN` RAT. Separate reporting also described Lazarus using fake hiring workflows and an NVIDIA-themed lure to trick victims into copying a malicious command that deployed credential theft tools, MeshAgent remote access, Python-based payloads, and cryptocurrency data theft components.
Aug 14, 2026