Lazarus Group's infrastructure reuse leads to discovery of new malware
Summary: Cisco Talos found that North Korea's Lazarus Group hosted its new CollectionRAT implant, QuiteRAT, open-source DeimosC2 agents, and a malicious Plink reverse-tunneling tool on the same infrastructure it used in its 2022 MagicRAT campaign. CollectionRAT is a packed MFC-based Windows binary that fingerprints the infected system, receives commands from a C2 server, can run a reverse shell, read and write files, spawn processes, and remove itself, and a 2021 CollectionRAT sample was signed with the same OSPREY VIDEO INC. certificate as EarlyRAT/Jupiter.
What's compelling: This is Lazarus Group's third documented campaign in less than a year, and the reused hosting and shared code-signing certificate tie the actor's ransomware work - flagged in CISA's February 2023 advisory on North Korean attacks against healthcare and critical infrastructure - directly to this tooling.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026