Lazarus hackers repeatedly breached development environments to deploy SIGNBT malware

Recently, while tracking Lazarus attack events, Cysec Security Labs discovered that it repeatedly attacked software vendors by exploiting flaws in vulnerable software. Despite developers of the relevant vendors providing patches and warnings multiple times, Lazarus succeeded through software supply chain attacks in numerous incidents.

The fact that Lazarus attacked the same victim multiple times indicates that the hackers' goal is to steal source code or attempt supply chain attacks.

"This recurring pattern of breaches indicates that the attackers are persistent and determined, likely aiming to steal valuable source code or tamper with the software supply chain. They continue to exploit vulnerabilities in company software while targeting other software manufacturers."

In July this year, Lazarus was discovered using a variety of infection chains and post-exploitation toolsets during its attacks.

The most recent attack has been grouped into a broader scope of Lazarus's campaign targeting multiple software vendors between March and August this year.

▍SIGNBT and LPEClient Malware

Lazarus's targets are legitimate security software used to encrypt network communications. However, the specific exploitation methods used by the hackers remain unknown.

The exploit resulted in the deployment of the SIGNBT malware as well as shellcode used to inject payloads into memory for covert execution.

Persistence was established by adding a malicious DLL ("ualapi.dll") to the startup to be executed by "spoolsv.exe" or by performing Windows Registry modifications.

The malicious DLL file performs a victim ID verification check before decrypting and loading the SIGNBT payload from the local file system path to ensure the infection proceeds to the intended target.

DLL side-loading path used by Lazarus in attacks

The name SIGNBT is derived from the distinct strings it uses for Command and Control (C&C) communication, sending information about the infected system, and receiving execution commands.

The commands supported by SIGNBT are:

• CCBrush: Handles functions such as obtaining system information, testing connections, and configuring settings.

• CCList: Manages processes, including obtaining running process lists, terminating processes, running files, and DLL operations.

• CCComboBox: Works with the file system, such as obtaining drive lists, changing file attributes, and creating new folders.

• CCButton: Downloads and uploads files, loads them into memory, and captures the screen.

• CCBitmap: Implements commonly used Windows commands and utilities.

SIGNBT can also retrieve additional payloads from C&C servers and deploy them on the host, providing Lazarus with more operational features.

Communication exchange between C&C server and SIGNBT

We found that Lazarus exploited this feature on SIGNBT to load credential dumping tools and LPEClient malware on infected systems.

Malware loading process

LPEClient itself is an information stealer and malware loader, and its latest version has evolved significantly compared to previously documented samples.

"It now employs advanced techniques to enhance its stealth and avoid detection, such as disabling user-mode system call hooks and restoring system library memory sections."

Lazarus integrated LPEClient into other campaigns this year, although it used the malware in early infection stages to inject other payloads.

Multiple Lazarus campaigns running concurrently in 2023

Overall, the Lazarus group remains one of the most active and dangerous threat groups, with a broad range of targets spanning multiple regions and industries.

Their recent operations highlight their carefully tailored tactics and persistence in achieving their goals. Companies need to address this by emphasizing the organizational need to proactively patch software and prevent vulnerabilities from being easily exploited for initial attacks.

Cysec Security reminds all enterprises, regardless of region or industry, that they need to be vigilant against the malicious behavior of the Lazarus threat group, as they may well be covered within its attack scope. It is highly necessary to verify the security defense system in advance.

The Cysec attack simulation library already includes the Lazarus group and SIGNBT malware. You can search for the keywords "Lazarus" or "SIGNBT" in the Cysec Security Metrics and Validation Platform to obtain relevant attack simulation validation actions, thereby verifying whether your security defense system is properly prepared to resist.