Loading story…
Lazarus-linked operators exploited unpatched VMware Horizon servers vulnerable to Log4Shell (CVE-2021-44228) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including VSingle, YamaBot, MagicRAT, and NukeSped, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused.
The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. VSingle supported remote command execution and file transfer, and newer Linux variants could fall back to GitHub to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. YamaBot, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while NukeSped provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos publicly attributed the February-to-July 2022 energy-sector intrusions to Lazarus with high confidence. The assessment was based on malware overlaps, infrastructure overlaps, and similarities to prior reporting and CISA advisories.
JPCERT/CC published analysis of YamaBot, a Golang backdoor used by Lazarus against both Windows and Linux systems. The report described its HTTP cookie-based C2 protocol, RC4-protected data exchange, and platform-specific command handling.
JPCERT/CC reported updated Linux-focused VSingle malware that retrieves replacement C2 information from attacker-controlled GitHub repositories when hard-coded C2 servers fail. The analysis also noted the Linux variant had shifted to using wget for network communications.
During the 2022 campaign, attackers exploited exposed VMware Horizon servers via Log4Shell and deployed Lazarus malware including VSingle, MagicRAT, and in some cases YamaBot. Talos also described hands-on-keyboard activity such as disabling Defender, reconnaissance, credential theft, lateral movement, and exfiltration.
Cisco Talos observed a Lazarus campaign between February and July 2022 targeting energy organizations, especially in the United States, Canada, and Japan. The intrusions aimed to establish long-term access and steal data for espionage purposes.
CVE-2021-44228 was publicly disclosed along with proof-of-concept material via Twitter and GitHub. This disclosure helped drive subsequent exploitation activity against exposed systems.
An initial patch for CVE-2021-44228 was released by Apache. The ASEC reference notes that additional patches followed afterward.
Alibaba’s cloud security team reported the Apache Log4j 2 vulnerability CVE-2021-44228 to the Apache Software Foundation. This was the earliest dated milestone cited for the Log4Shell issue later exploited in Lazarus activity.
JPCERT/CC published analysis of Lazarus operations targeting Japanese organizations using the VSingle and ValeforBeta malware families. The report detailed their HTTP-based C2 mechanisms, capabilities, and associated infrastructure.
ASEC found evidence that other attackers had previously exploited the same vulnerable system to deploy Jin Miner before Lazarus installed NukeSped. This showed the exposed VMware Horizon target had been compromised by multiple actors.
ASEC observed suspected Lazarus exploitation of unpatched VMware Horizon systems using Log4Shell in April. The attackers used PowerShell launched by VMware Horizon processes to install the NukeSped backdoor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourceblogs.jpcert.or.jp
Open sourceblogs.jpcert.or.jp
Open sourceasec.ahnlab.com
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lazarus targeted South Korean organizations through watering-hole attacks and spearphishing, abusing vulnerable local security software including **INITECH INISAFE CrossWeb EX** and **DreamSecurity MagicLine** to gain initial access and execute malware. AhnLab linked one 2022 wave to a signed INITECH process, `inisafecrosswebexsvc.exe`, after a malicious `SCSKAppLink.dll` was injected to fetch additional payloads from attacker-controlled infrastructure. Across multiple campaigns, victims included defense, finance, media, IT, public-sector, manufacturing, logistics, and pharmaceutical organizations, with reports describing more than 100 incidents and repeated use of compromised Korean websites, IP filtering, staged loaders, DLL side-loading, Windows service abuse, and persistence via the LSA Security Packages registry path. After compromise, Lazarus deployed backdoors including **NukeSped** and in some cases escalated to kernel-level evasion using a **bring your own vulnerable driver** technique. AhnLab said the group abused the signed but vulnerable `ene.sys` driver, and in some variants Dell's `CVE-2021-21551` driver path, to obtain arbitrary kernel memory access and disable security controls in memory, including file and registry callbacks, process and thread monitoring, WFP network filters, and ETW tracing. The activity also involved lateral movement through WMI, and sometimes RDP or SSH, plus credential theft, keylogging, screen capture, SOCKS tunneling, port forwarding, and internal reconnaissance, underscoring a sustained espionage-focused campaign that also created opportunities for supply-chain access and financial theft.
Aug 15, 2026
Researchers tied the **VHD ransomware** and related families including **BEAF, PXJ, ZZZZ, CHiCHi, and Tflower** to DPRK-affiliated operators, with Trellix and Kaspersky linking the activity to **Lazarus/APT38/Unit 180**. The reporting says the campaigns were narrowly targeted, especially in the APAC region, and appeared aimed at revenue generation rather than mass extortion. Investigators cited shared code, overlapping artifacts, near-identical visual patterns, a reused ProtonMail address, and the use of the **MATA** framework as evidence that these ransomware strains were not typical criminal affiliate tools but part of a state-linked operation. Kaspersky described two 2020 intrusions in which attackers exploited a vulnerable VPN gateway, escalated privileges, deployed **MATA**, seized **Active Directory**, and pushed VHD across victim networks within hours; another case used a custom SMB brute-force spreading tool with propagation over mounted shares and **WMI**. Separate research from Netlab 360 and VMware detailed **Dacls**, also known as **MATA**, as a cross-platform Lazarus-linked RAT for Windows and Linux that uses TLS and RC4-protected command-and-control, modular plugins, and infrastructure that remained active across more than 100 identified C2 servers. Earlier ESET analysis placed the activity within Lazarus’s broader pattern of combining espionage, sabotage, and financially motivated operations through multiple code-sharing development cells.
Aug 15, 2026
The North Korea-linked **Lazarus Group** expanded its long-running **Operation DreamJob** espionage campaign by using recruiter-themed lures, impersonation sites, and trojanized PDF software to compromise defense, aerospace, aviation, and UAV-related organizations in Europe, India, and other regions. Researchers said victims were sent tailored job descriptions through email, messaging platforms, and password-protected archives, then tricked into opening decoy documents with modified PDF readers that delivered malware including **ScoringMathTea**, **MISTPEN**, **ForestTiger**, and related loaders. ESET and Mandiant linked the activity to cyberespionage and theft of proprietary technology, with particular interest in drone manufacturing know-how and other sensitive defense-sector information. Check Point reported that the campaign escalated access by exploiting **`CVE-2026-68820`**, a zero-day local privilege escalation flaw in Microsoft **AFD.sys**, to deploy the **FudModule** rootkit with **SYSTEM** privileges and reduce endpoint detection visibility; Microsoft patched the issue on August 11, 2026. The operation also abused vulnerable **Roundcube** servers via **`CVE-2025-49113`** and installed the **RelayShell** PHP webshell to convert compromised web servers into command-and-control relay nodes, while compromised organizations were reused to spear-phish additional targets. Across the reporting, Lazarus showed a consistent pattern of evolving DreamJob tradecraft through trojanized open-source software, encrypted payload staging, DLL proxying, and use of trusted third-party infrastructure to improve stealth and credibility.
Aug 15, 2026