Some commentary on LAZARUS tradecraft, as detailed in the Justice Department indictment:
justice.gov/opa/pr/north-k…
Perhaps most striking, consistent throughout the indictment, is the entirely inconsistent application of digital tradecraft in LAZARUS' operations (1/6)
justice.gov/opa/pr/north-k…
Perhaps most striking, consistent throughout the indictment, is the entirely inconsistent application of digital tradecraft in LAZARUS' operations (1/6)
Across ops with different goals in different AORs, the DoJ was able to identify source range IPs (both NK and Chinese) connecting to various elements of operational infrastructure and personas. Proxy and cut-out infrastructure existed, but it was used unevenly (2/6)
This is more acute of an issue considering the nature of the ops: destruction (SPE & WannaCry) and financial (banks) & data (defense contractors) theft aren't necessarily clandestine, and a response (forensic and otherwise) should have been expected, thus encouraging (3/6)
a more disciplined use of infrastructure and tooling. Specific to the SPE op: the operation only turned overt after a few months of clandestine access to the tgt network. This is a short time period to establish access and collect data & create the right conditions (4/6)
for wide-scale destruction. But the outcome was more perception than reality, as the number of forensic artifacts left behind and connected back to LAZARUS, combined with the lack of real long term affect on SPE, casts significant doubt on the "success" of the operation. (5/6)
It's an impressive compendium of info linking North Korea to LAZARUS, and LAZARUS to various well known attacks: SPE, Bank of Bangladesh, WannaCry, and other intrusions. It's further evidence that a nation-state can be effective while making massive tradecraft mistakes (6/6).
