Operation Blockbuster: Coverage for the Lazarus Group
Summary: Novetta researched a set of malware families tied to the threat actors dubbed the Lazarus Group (Group 77), which its Operation Blockbuster report says were behind multiple high-profile attacks over the previous nine years. Cisco Talos examined samples of the malware families provided by Novetta and verified that its Snort rules and Clam AV signatures detect all of them.
What you should know: The Lazarus Group's malware families were linked to multiple high-profile attacks across nine years, so a security leader's detection coverage has to hold against a toolset that has stayed in use and evolved over that span, not a single campaign.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026