ESET Lazarus Jun 2020

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.

During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.

During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.

During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.

During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.

During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.

During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.

During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.

During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.

During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.

During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.

During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.

During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.

For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.

For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.

During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.