Threat video1:00
Lazarus Group ScoringMathTea Drones: Detection & IOCs
Lazarus returns to drone lures with ScoringMathTea and DeceptiveDevelopment injects code into repos. Get 9 detection rules, 26 IOCs and a free Splunk SPL rule.
Read the full threat intel for Lazarus Group ScoringMathTea Drones: Detection & IOCs →
Chapters
- 0:00The hookLazarus resumed drone targeting.
- 0:04The storyDeceptiveDevelopment now harvests developer credentials.
- 0:11Attack pathRecruitment lures reach drone organizations.
- 0:23AttributionAttributed to Lazarus Group.
- 0:27Indicators of compromise16 indicators to hunt: 8 IPs, 1 domain and 6 SHA-1 hashes, and more.
- 0:34MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:39Remediation4 steps now: Hunt for DLL side-loading of trojanized WinMerge/Notepad++/MuPDF/TightVNC components and legitimate.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Lazarus resumed drone targeting.
0:05DeceptiveDevelopment now harvests developer credentials.
0:09Then repository compromise.
0:11Recruitment lures reach drone organizations.
0:14Trojanized reader opens, then BinMergeLoader fetches via Microsoft Graph.
0:20ScoringMathTea has about 40 commands.
0:23Attributed to Lazarus Group. Confidence: medium.
0:2716 indicators to hunt: 8 IPs, 1 domain and 6 SHA-1 hashes, and more.
0:3416 ATT&CK techniques, from resource development to command and control.
0:404 steps now: Hunt for DLL side-loading of trojanized WinMerge/Notepad++/MuPDF/TightVNC components and legitimate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.