Loading story…
Palo Alto Networks Unit 42 reported a sustained spearphishing campaign linked to the Lazarus group that targeted Korean-speaking individuals and later people associated with U.S. defense contractors. The attackers used weaponized Microsoft Office documents with malicious VBA macros, first relying on Korean-language decoys and later shifting to English-language job descriptions and internal policy material tied to defense firms. Researchers said the activity remained active through mid-2017 and showed little operational change despite earlier public exposure.
The malware and delivery chain shared multiple traits with Operation Blockbuster and the later Blockbuster Sequel, including packed payloads, fake TLS-like communications, hard-coded command-and-control infrastructure, encoded strings, cleanup batch scripts, direct IP beaconing, and overlapping macros, XOR keys, and infrastructure. Unit 42 also found reused compromised hosts serving lure files, metadata such as the author name ISkyISea, and evidence of an automated document weaponization process, leading researchers to assess that the operators were either the same Lazarus-linked actors or closely cooperating with them.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that the intrusion campaign remained active through July 2017 and had shifted decoy themes to English-language job descriptions and internal policy material from U.S. defense contractors.
A malicious file named "한싹시스템.doc" was submitted to VirusTotal as part of the spearphishing campaign Unit 42 investigated.
The unpacked payload with SHA256 032ccd6ae0a6e49ac93b7bd10c7d249f853fff3f5771a1fe3797f733f09db5a0 carried a compile timestamp of March 2, 2017.
Based on overlaps in tools, payloads, macros, XOR keys, infrastructure, and command-and-control behavior, Unit 42 assessed the operators were the same group behind or closely cooperating with the actors from Operation Blockbuster Sequel and ultimately Operation Blockbuster.
After the earlier Korean-language lure activity, Unit 42 discovered continued intrusion activity targeting individuals associated with United States defense contractors using weaponized Office documents.
By pivoting on reused macro logic and variable names, Unit 42 found additional malicious documents and testing files, suggesting an automated document weaponization process and possible English-speaking involvement.
Unit 42 analyzed a 2017 campaign using malicious Word documents with VBA macros targeting Korean-speaking individuals and attributed it to Lazarus based on overlaps in malware code, infrastructure, and protocol behavior.
Unit 42 referenced the 2014 Sony Pictures Entertainment attack as prior activity tied to the Lazarus group in its attribution discussion.
Unit 42 cited the 2013 DarkSeoul attacks as earlier operations associated with the Lazarus group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026
Researchers linked a targeted malware campaign to the **Lazarus Group** after attackers distributed malicious Microsoft Word files masquerading as Korean job postings, including a fake Cisco Korea systems engineer listing. The lure documents, including **"Job Description.doc"** and **"Job Descriptions.doc"**, used heavily obfuscated VBA macros that required victims to enable macros before dropping a PE32 payload named **`jusched.exe`**, disguised as **Java Update Scheduler**, into **`%APPDATA%\Roaming`**. The documents also displayed a decoy job description to reduce suspicion while the malware executed in the background. Analysis from ESRC and Cisco Talos found the malware used an **XOR `0xE7`** decryption routine, similar macro obfuscation, and reused command construction techniques previously seen in earlier Lazarus operations. The payload attempted to contact compromised legitimate websites over HTTP, including **`secuvision.co.kr`**, to retrieve follow-on commands or second-stage malware. Investigators tied the activity to prior Lazarus campaigns such as **Operation Arabian Night**, **Coin Manager**, and related 2017 job-themed intrusions, indicating a sustained pattern of using employment lures and compromised websites to gain initial access to targeted organizations.
Aug 15, 2026
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026