Threat video1:00
Lazarus Group DreamJob and npm Poisoning: Detection & IOCs
Lazarus lures European drone makers with fake jobs and poisons npm packages: 9 detection rules, 28 IOCs and a free Splunk SPL rule.
Read the full threat intel for Lazarus Group DreamJob and npm Poisoning: Detection & IOCs →
Chapters
- 0:00The hookAbout June, Lazarus is back on drones.
- 0:04The storyFake job lures target European defense.
- 0:11Attack pathLazarus built trojanized tools and compromised webmail relays.
- 0:28AttributionAttributed to Lazarus Group.
- 0:32Indicators of compromise20 indicators to hunt: 1 IP, 5 domains and 4 URLs, and more.
- 0:38MITRE ATT&CK techniques19 ATT&CK techniques, from resource development to command and control.
- 0:44Remediation12 remediation steps are listed, 5 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About June, Lazarus is back on drones.
0:05Fake job lures target European defense.
0:07Another cluster poisons software packages.
0:11Lazarus built trojanized tools and compromised webmail relays.
0:16One defense firm opened a trojanized viewer. ScoringMathTea was the main tool.
0:21Poisoned npm packages steal Git credentials and SSH keys.
0:28Attributed to Lazarus Group. Confidence: medium.
0:3220 indicators to hunt: 1 IP, 5 domains and 4 URLs, and more.
0:3919 ATT&CK techniques, from resource development to command and control.
0:4412 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.