The Blockbuster Sequel
Summary: Unit 42 identified malware with code, infrastructure, and themes overlapping the Operation Blockbuster report on the Lazarus group, which is tied to the 2014 Sony Pictures attack and the 2013 DarkSeoul attacks. The activity targets Korean-speaking individuals through malicious Word documents carrying VBA macros that drop a UPX-packed payload compiled March 2, 2017, which beacons to hard-coded IPv4 command-and-control servers using a fake TLS protocol.
What's compelling: The implant reuses the same fake TLS protocol, string interpolation, and a cleanup batch script whose hash matches a sample described in a 2016 Blue Coat report linking DarkSeoul to the Sony breach - a group tied to destructive attacks is still developing its tooling against Korean-speaking targets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026