Thread by @ESETresearch

#ESETResearch confirms Lazarus is linked to the recent #3CX supply-chain attacks. Based on code similarities and network infrastructure, we connect the 3CX incident with a Linux case of DreamJob, a long-term Lazarus operation using job offer as lures. 1/6 welivesecurity.com/2023/04/20/lin…

First, let’s look at the timeline. It shows that the trojanized macOS version of the 3CX Desktop App was ready two months prior to the distribution of the Windows version. Also interesting is that the attack was in preparation as early as December 2022. 2/6

It was reported that Mandiant has found Mac malware they call SIMPLESEA inside the 3CX network. While we do not have the sample, their description of this malware overlaps with second-stage Linux malware we found while investigating a recent Operation DreamJob case. 3/6

This second-stage Linux malware, which we call SimplexTea, also stores its single-byte-XORed configuration in a file named “apdl.⁠cf”, implements a stream cipher based on A5/1, and connects to journalide[.]org, a domain mentioned in the 3CX incident summary. 4/5

Three 32-bit integers, 0xC2B45678, 0x90ABCDEF, and 0xFE268455, used a key material for a custom implementation of the A5/1 cipher, were used in Windows malware that dates back to the end of 2014: the infamous cybersabotage of Sony Pictures Entertainment. 5/6

See @pkalnai and @marc_etienne_’s full article on WeLiveSecurity for more details. IoCs can be found in our GitHub repository: github.com/eset/malware-i… 6/6