Lol Zarus: Lazarus Group Incorporating Lolbins into Campaigns | Qualys
Summary: Qualys Threat Research identified a Lazarus campaign using employment phishing documents named "Lockheed_Martin_JobOpportunities.docx" and "Salary_Lockheed_Martin_job_opportunities_confidential.doc", both authored by a user named "Mickey", targeting job applicants at Lockheed Martin. The macros load WMVCORE.DLL, decode embedded shellcode via CryptStringToBinaryW, hijack control flow through the KernelCallbackTable pointer, and set up a beacon to markettrendingcenter[.]com every 20 minutes using renamed wscript.exe and mshta.exe, with other variants using wuauclt, wmic, and pcalua.exe.
What's compelling: Lazarus is posing as defense employers like Lockheed Martin, Northrop Grumman, and BAE Systems to reach people who are actively job-hunting, and the payload persists through a scheduled task firing every 20 minutes - a cadence your endpoint controls may never flag.
Read the original at Qualys Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026