#ESETresearch discovered a supply-chain attack performed by #Lazarus APT group against South Korean 🇰🇷 internet users. @cherepanov74 @pkalnai welivesecurity.com/2020/11/16/laz… 1/7
WIZVERA VeraPort software is often used on internet banking and government websites in 🇰🇷 South Korea. The purpose of this software is to install additional security software required by some of these websites. 2/7 
The attackers abused a combination of WIZVERA VeraPort software and compromised South Korean websites with VeraPort support, to deploy Lazarus malware. 3/7
The #Lazarus malware pushed via this supply chain was signed with code-signing certificates issued to two different companies. 4/7
This #Lazarus malware and campaign have similarities with the activity previously published by 🇰🇷 Korea Internet & Security Agency in their Operation BookCodes reports. 5/7
https://twitter.com/kisa118/status/1277424101393489921
One #Lazarus sample delivered via this supply-chain attack contains the string ohayogonbangwa!!. This is the romaji version of the 🇯🇵 Japanese phrase おはようこんばんぐぁ, which translates as “Good morning, good evening”. 6/7
• • •
Missing some Tweet in this thread? You can try to
force a refresh
