Lazarus Group’s Undercover Operations 2022–2023

Lazarus Group’s Undercover Operations 2022–2023

Speakers: Taewoo Lee (Malware Analyst, KISA / KrCERT/CC), Seulgi Lee (Malware Analyst, KISA / KrCERT/CC), Dongwook Kim (Incident Analyst, KISA / KrCERT/CC)

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=B5hYzdCSQ2E

Overview

This talk, "Lazarus Group’s Undercover Operations 2022–2023," presented by analysts from the Korea Internet and Security Agency (KISA / KrCERT/CC), unveils the sophisticated tactics, techniques, and procedures (TTPs) employed by the notorious Lazarus Group in their Operation Gold Goblin. The operation primarily targeted South Korean financial security software development companies, news media outlets, and defense industries, exploiting zero-day vulnerabilities in widely used financial security software. This campaign is particularly alarming due to its broad impact, potentially affecting an estimated 10 million user devices within South Korea's unique internet banking ecosystem.

The core of Operation Gold Goblin revolved around watering hole attacks orchestrated through compromised news media websites. By exploiting vulnerabilities in financial security software, which is mandatory for internet banking in Korea and runs persistently on user systems, Lazarus Group achieved initial access. This initial foothold was then leveraged to infiltrate internal networks, steal critical information—including the source code of the targeted financial security software—and establish persistent command and control (C2) infrastructure. The speakers, Seulgi Lee, Dongwook Kim, and Taewoo Lee, meticulously dissected the incident, providing a detailed analysis of the attack chain, the malicious code used, and the striking correlations with previous Lazarus Group campaigns, underscoring the group's continuous evolution and strategic reuse of stolen intellectual property.

The significance of this talk extends beyond the technical intricacies of the attack. It exposes a critical systemic vulnerability within the South Korean financial landscape, where mandatory, deeply integrated, and custom-distributed security software creates a fertile ground for sophisticated adversaries. The Lazarus Group's ability to weaponize stolen source code to develop new zero-day exploits highlights a dangerous supply chain compromise, posing an existential threat to financial stability and national security. KISA's comprehensive investigation and public disclosure serve as a crucial warning to defenders worldwide about the escalating sophistication of state-sponsored threat actors and the complex challenges in securing critical digital infrastructure.

Background

▶ Watch: Introduction to Lazarus Group's Operation Gold Goblin (0:00)

The unique landscape of South Korea's internet banking environment forms the critical backdrop for Operation Gold Goblin. To conduct online financial transactions, individuals are mandatorily required to install specific financial security software. This isn't a mere browser plugin; it's a deeply integrated application that often runs 24/7 on a user's computer from boot-up, even without actively logging into a bank. This pervasive presence means that vulnerabilities in this software can expose a vast user base to continuous risk.

Adding to this inherent risk is the software's distribution model. Financial security software development companies provide their products to individual banks, which then customize and distribute these versions to their customers. This customization and fragmented distribution lead to significant challenges in patch management. Banks often conduct thorough examinations and verifications before deploying software updates, leading to delayed vulnerability patches. As a result, different banks may operate different versions of the software, and even when a patch is released, users are only updated when they connect to their specific bank. This creates a scenario where some users remain vulnerable for extended periods, even if a patch exists, simply because they haven't accessed their bank or their bank is still deploying an older, vulnerable version. The speakers illustrated this with an example of "Bank Alpha" deploying patched software while "Bank Beta" still distributes vulnerable versions, leaving users connected to Bank Beta, or even those not using internet banking at all, exposed. This fragmented ecosystem meant that an estimated 10 million user devices in Korea were potentially running vulnerable software during Operation Gold Goblin.

The Lazarus Group's involvement in this incident is not isolated but rather a continuation of their long-standing TTPs and strategic objectives. KISA identified strong connections between Operation Gold Goblin and three previously known Lazarus clusters: Operation Bookcode (discovered by KISA in 2020), Operation Dreamjob (also known as Deathnote, targeting aerospace/defense), and Forchair (a remote administration tool identified by CISA in 2017). Operation Bookcode, in particular, involved watering hole attacks abusing security software vulnerabilities and targeting news media and security software developers. Crucially, the talk revealed that Lazarus Group had previously stolen source code of security software from a development company in a 2020 operation. This stolen intellectual property was subsequently analyzed and weaponized to create the zero-day exploits used in Operation Gold Goblin, demonstrating a dangerous cycle of compromise, analysis, and re-weaponization within the supply chain. This history underscores why the problem exists: a confluence of mandatory, always-on software, a fragmented patching ecosystem, and a persistent, sophisticated adversary capable of exploiting these systemic weaknesses over extended periods.

Key Findings

▶ Watch: Two zero-day vulnerabilities for initial access and lateral movement (17:00)

Operation Gold Goblin revealed several critical findings that highlight the Lazarus Group's advanced capabilities and strategic methodology:

1. Two Zero-Day Vulnerabilities Exploited: The Lazarus Group successfully leveraged two distinct zero-day vulnerabilities within the financial security software. One was used for initial access, primarily through targeted watering hole attacks, while the other facilitated lateral movement within compromised networks. While specific details on the vulnerability principles were withheld due to security provisions, their existence underscores a significant flaw in widely deployed software.

1. Targeted Watering Hole Attacks via News Media: Initial infiltration was achieved by compromising specific news media websites. The attackers inserted IP filtering code into these sites. If a visitor's IP address matched a target company, they were redirected to a malicious website designed to trigger the initial access zero-day vulnerability in their financial security software. This sophisticated targeting mechanism allowed the attackers to selectively infect high-value targets while maintaining a low profile.

1. Compromise of Financial Security Software Development Company: A pivotal success for Lazarus Group was the compromise of a financial security software development company. During this intrusion, the attackers not only infiltrated key internal information assets but also stole the source code of the very software they were exploiting. This theft is a critical finding, as the speakers revealed that Lazarus subsequently analyzed this stolen source code to create additional exploits, illustrating a dangerous supply chain attack vector.

1. Widespread Impact and Systemic Risk: The exploited financial security software has a widespread impact in South Korea, affecting an estimated 10 million user devices. The pervasive nature of this software, running 24/7 on user PCs, meant that a successful comprehensive cyberattack using system destruction could have caused "serious social disruption," emphasizing the scale of the threat.

1. Multi-Stage Malware and Web-Based C2: The operation involved at least four distinct malicious code samples, each playing a specific role in the attack chain, from initial download to remote control and data exfiltration. Lazarus maintained a sophisticated web-based command and control (C2) system, characterized by building C2 servers on compromised internal network servers, even those not connected to the internet, to control internal systems. This included installing IIS web servers on backup servers for internal C2.

1. Advanced Persistence and Evasion Techniques: Lazarus Group employed various methods to maintain persistence, including registering malware in Windows authentication-related registry entries and storing malicious code in the system32 directory, often disguised with normal service names. They also used regenerate tools like WWMIR from NearSoft for network scanning to evade anti-virus detection and utilized proxies such as ping lcx and htran to hide their attacking IP addresses. For privilege escalation, the Print Nightmare vulnerability was frequently exploited.

1. Strategic Reuse and Evolution of TTPs: The analysis firmly established connections between Operation Gold Goblin and previous Lazarus campaigns like Bookcode, Dreamjob, and Forchair. This included similar watering hole strategies, web-based C2 server characteristics, and even specific malware algorithms and string replacement methods. The evidence suggests that information and capabilities gathered in prior incidents, such as the stolen source code from 2020's Operation Bookcode, were directly leveraged for the evolution of attacking techniques in Gold Goblin.

Technical Deep Dive

▶ Watch: How Lazarus penetrated and controlled the internal network (22:00)

The technical analysis of Operation Gold Goblin reveals a meticulously planned and executed campaign, leveraging bespoke exploits and a multi-stage malware infrastructure.

The initial infiltration began with a targeted watering hole attack. Lazarus Group compromised specific news media websites, injecting IP filtering code. When a user from a target company (identified by their IP range) accessed the compromised news site, they were silently redirected to another malicious web page. This page contained code designed to exploit the first zero-day vulnerability in the financial security software.

Initial Access Vulnerability

The initial access vulnerability exploited a weakness in a specific module function of the financial security software. This involved TCP socket communication between the malicious site and the security software module. By exploiting a directory traversal vulnerability within this module, the attackers could download a malicious file from an external source. The downloaded malware was typically placed in the Windows\Public or ProgramData paths and subsequently injected into the legitimate financial security software process. This activity left behind specific parameter values in the malicious site's web logs, which KISA used for forensic analysis.

Lateral Movement Vulnerability

Once initial access was gained, Lazarus Group utilized a second zero-day vulnerability for lateral movement within the victim's network. This vulnerability manifested as a stack-based overflow crash in a different specific security program. This program, residing in Windows, would open a certain port and process certificate values. The vulnerability arose from a failure in the memcpy function to properly check the size of data being copied, leading to a buffer overflow. This S override vulnerability could result in arbitrary code execution, allowing the attackers to spread their malicious code from an infected PC to other systems within the network. While primarily used for lateral movement, KISA noted that this vulnerability had also recently been observed being used for initial access in other contexts.

Malware Analysis

KISA identified four primary malicious code samples used in Operation Gold Goblin:

1. SC_CSKMLink.dll: This malware, known as Rocket Downloader, was primarily used for initial access. It was designed to mimic a legitimate security software module name. Upon execution, it connected to additional download locations, downloaded final payloads, and injected itself into memory. Crucially, after successful execution, SC_CSKMLink.dll would delete itself and clear traces of its penetration, making forensic analysis more challenging.

1. ER_MO.dll, PRO.sys, and MI.dll: These three samples functioned as a paired set for decrypting and executing additional encrypted components. They often injected code into memory to decrypt content using arguments or keys hardcoded within the malware.

• ER_MO.dll: This served as a loader. It would read an encrypted value from a specific registry path, decrypt it, and then execute the decrypted content. The configuration information (including C2 addresses, service names, and malware passwords) stored in the registry was initially encrypted with RC5, but KISA observed a shift to the AES algorithm in more recently discovered samples. This malware was also identified as a type of remote control.

• PRO.sys: This malicious code was typically stored in the Windows\System32 directory. Its filename often consisted of two random characters as the prefix (e.g., xx_PRO.sys), and its configuration input value name in the infected system mirrored this random naming convention.

• MI.dll: This sample employed DLL side-loading techniques. It would drop a legitimate program, WSMProHost.exe, into the same directory as the malicious MI.dll. When WSMProHost.exe was executed, it would inadvertently load the malicious MI.dll. The decryption key for MI.dll's parameters was derived from the MD5 hash of the infected system's computer name, using its first 16 bytes. The decrypted parameter value contained the encrypted name of the actual remote control malware, UsoData.dat, which MI.dll then loaded. The parameter value itself was encrypted with AES and encoded in Base64.

Persistence and Evasion

Lazarus Group demonstrated robust persistence mechanisms:

• Malware was registered in Windows authentication-related registry entries to ensure automatic execution.
• The system32 directory was favored for storing malicious code, particularly PRO.sys, to blend in with legitimate system files.
• Malicious services were often given normal-looking service names to appear as legitimate software, though they sometimes left logs of delayed service execution and failed events.

For evasion and operational security:

• Network scanning was conducted using legitimate tools like WWMIR (a tool from NearSoft), which generates WMI.exe, to avoid detection by traditional anti-virus solutions.
• Attackers extensively used proxies such as ping lcx and htran to obfuscate their attacking IP addresses and bypass firewalls.
• Privilege escalation was frequently achieved by exploiting the Print Nightmare vulnerability.

Command and Control (C2) Infrastructure

A hallmark of Lazarus Group's operations, and evident in Gold Goblin, is their web-based C2 system. After infiltrating a server within the victim's internal network (even one without direct internet connectivity), they would install an IIS web server on it. This allowed them to establish a secondary, internal C2 server, enabling control over internal systems and the exfiltration of sensitive data without direct external communication from every compromised endpoint. This technique was also observed in their 2018 infiltration of cryptocurrency exchanges, where they created C2 web pages on document management servers. In Gold Goblin, this was extended to backup servers after stealing VPN account credentials.

Demo / Proof of Concept

▶ Watch: Attributing Gold Goblin to known Lazarus attack clusters (32:00)

While the KISA speakers did not present a live, interactive demonstration of the exploits during their talk, their presentation served as a detailed forensic reconstruction and technical proof of concept of the Lazarus Group's capabilities and attack chain. The meticulous analysis of the incident, malware samples, and network traces effectively "demonstrated" how the attack unfolded, from initial compromise to internal network control and data exfiltration.

The talk described the re-creation of the initial infection vector: a virtual machine (VM) company accessing a watering hole page, being redirected to an exploit page, subsequently getting infected by SC_CSKMLink.dll, and then communicating with the C2 server before the malware self-deleted. This re-creation validated the initial access method and the effectiveness of the first zero-day exploit.

Furthermore, the entire incident itself, particularly the compromise of the financial security software development company and the subsequent theft of its source code, served as a stark proof of concept for the Lazarus Group. The attackers' ability to analyze this stolen source code and then weaponize it to create new zero-day vulnerabilities (like the lateral movement exploit) against other targets demonstrated a highly advanced capability for persistent and evolving cyber warfare. This highlights not just an attack, but a strategic investment by the adversary in weaponizing intellectual property to perpetuate further compromises within the supply chain. The detailed walkthrough of the internal network penetration, including the installation of IIS web servers on backup servers for internal C2, also served as a conceptual demonstration of their sophisticated post-exploitation and internal control capabilities.

Defensive Implications

▶ Watch: Q&A: Internal network malware connecting to C2 (43:30)

The Lazarus Group's Operation Gold Goblin underscores several critical defensive implications for organizations, particularly those in financial, defense, and software development sectors, and for national cybersecurity agencies.

1. Supply Chain Security and Software Vetting: The most profound implication is the vulnerability of the software supply chain. Organizations relying on third-party software, especially those with deep system privileges (like financial security software), must implement rigorous vetting processes. This includes not only checking for known vulnerabilities but also demanding assurance of the developer's internal security posture to prevent source code theft and subsequent weaponization. For software developers, protecting intellectual property, especially source code, must be a top priority.

1. Rapid and Centralized Patch Management: The fragmented and delayed patching model observed in the Korean internet banking environment is a critical weakness. Software vendors and regulatory bodies must collaborate to establish mechanisms for rapid, centralized, and mandatory deployment of security patches. Users should not be left vulnerable due to individual bank deployment cycles or infrequent access. Automatic updates for critical security software should be a default, with robust testing frameworks to ensure compatibility without undue delay.

1. Enhanced Network Segmentation and Access Control: The attackers' ability to penetrate internal networks and establish internal C2 servers highlights deficiencies in network segmentation. Organizations must enforce strict separation between external-facing networks and critical internal assets. Zero-Trust principles should guide access control, especially for VPNs. All remote access points, including VPNs, must be secured with multi-factor authentication and continuously monitored for anomalous activity. Regular audits of network configurations and access policies are essential.

1. Proactive Vulnerability Management and Penetration Testing: Given the exploitation of two zero-day vulnerabilities, organizations need to move beyond reactive patching. This includes proactive scanning for vulnerabilities in all deployed software, especially those with high privileges or widespread usage. Regular, aggressive penetration testing—including red team exercises simulating sophisticated state-sponsored attacks—can help identify exploitable weaknesses before adversaries do. Emphasis should be placed on discovering logic flaws and obscure vulnerabilities in deeply integrated software.

1. Advanced Endpoint Detection and Response (EDR) and Threat Hunting: Traditional anti-virus is insufficient. Organizations need robust EDR solutions capable of detecting sophisticated malware behaviors, such as process injection into legitimate security software, registry modifications for persistence (especially in authentication-related entries), and the dropping of suspicious files in system directories like system32 or ProgramData. Threat hunting teams should actively look for TTPs observed in Gold Goblin, including:

• Unusual TCP socket communications by security software modules.
• Execution of WMI.exe (WWMIR) or other legitimate tools for network scanning.
• Presence of known Lazarus proxy tools (ping lcx, htran).
• Exploitation attempts related to Print Nightmare or similar privilege escalation vulnerabilities.
• DLL side-loading attempts involving common system processes (WSMProHost.exe).

1. Employee Awareness and Watering Hole Defense: Employees, particularly those in media, defense, or critical infrastructure, must be educated about the risks of watering hole attacks. This includes vigilance when accessing news websites or other common online resources. Organizations should implement robust web filtering, browser isolation technologies, and continuous monitoring of web traffic for suspicious redirects or content injection.

1. Incident Response and Forensic Capabilities: The self-deleting nature of SC_CSKMLink.dll and the clearing of traces emphasize the need for advanced incident response and forensic capabilities. Organizations must ensure comprehensive logging across their environment, including web server logs, endpoint logs, and network flow data, to aid in post-compromise analysis and attribution.

Key Takeaways

• Lazarus Group's Sophisticated Zero-Day Exploitation: Lazarus Group demonstrated advanced capabilities by exploiting at least two distinct zero-day vulnerabilities in widely used financial security software, enabling both initial access and lateral movement.
• Systemic Vulnerability of Mandatory Software: South Korea's internet banking ecosystem, with its mandatory, always-on financial security software and fragmented patching model, created a critical systemic vulnerability that Lazarus Group skillfully exploited, potentially affecting 10 million devices.
• Dangerous Supply Chain Compromise: The theft and subsequent weaponization of financial security software source code from a development company highlight a severe supply chain attack, where intellectual property is leveraged to create new, potent exploits.
• Advanced Multi-Stage Attack Chain: Operation Gold Goblin involved sophisticated watering hole attacks via compromised news media sites, multi-stage malware (including self-deleting components and DLL side-loading), and the establishment of hidden, internal web-based C2 servers for persistent control.
• Evolving TTPs and Persistent Threat: The campaign showcased Lazarus Group's continuous evolution, strategic reuse of TTPs from previous operations (Bookcode, Dreamjob, Forchair), and their ability to adapt and refine their attack methodologies over time.
• Urgent Need for Proactive Defense: Defenders must prioritize supply chain security, implement rapid and centralized patching, enhance network segmentation, and invest in advanced EDR and threat hunting capabilities to counter such sophisticated and persistent state-sponsored threats.

About the Speaker(s)

The presentation on "Lazarus Group’s Undercover Operations 2022–2023" was delivered by a team of experts from the Korea Internet and Security Agency (KISA) / KrCERT/CC, a leading cybersecurity organization in South Korea.

Seulgi Lee is a Malware Analyst at KISA / KrCERT/CC. Her responsibilities include profiling attack groups and working closely with her colleagues on incident analysis. She was the first speaker, providing an overview and background of the Operation Gold Goblin incident.

Dongwook Kim is an Incident Analyst at KISA / KrCERT/CC, bringing almost 10 years of experience in handling significant cybersecurity incidents in Korea. He provided a microscopic perspective on how the incident unfolded, detailing the incident analysis and the techniques used by Lazarus Group.

Taewoo Lee is also a Malware Analyst at KISA / KrCERT/CC. He has extensive experience in malware analysis and profiling work. Taewoo presented the detailed analysis of the malicious code samples used in the operation, along with the correlations found with previous Lazarus Group attacks, and concluded the presentation.