Trusted Design

Lazarus group: Operation Blockbuster

概要

The Lazarus Group’s activity spans multiple years, going back as far as 2009. However, their activity spikes starting with 2011. The group deployed multiple malware families throughout the years, including malware associated with Operation Troy and DarkSeoul, the Hangman malware (2014-2015) and Wild Positron / Duuzer (2015). The group is known for spearphishing attacks, which include CVE-2015-6585, which was a zero-day vulnerability at the time of discovery. During our analysis of the malware from the SPE attack as well as the connected malware families mentioned above, we observed certain specific traits shared between samples used in separate attacks. In general, such similarities are instances of code sharing and indicate the existence of a relationship between the malware families, which can be used to paint a more complete picture of a threat actor. We describe some of these overlapping features below. Source: https://securelist.com/blog/incidents/73914/operation-blockbuster-revealed/

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.66)
• New POS Malware Emerges - Punkey (score: 0.65)
• Exploring Bergard: Old Malware with New Tricks (score: 0.64)
• Stegoloader: A Stealthy Information Stealer (score: 0.64)
• New Targeted Attack Group Buys BIFROSE Code, Works in Teams (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る