Lazarus Group / Bluenoroff APT threat

What is LAZARUS-BLUENOROFF-APT?

LAZARUS_BLUENOROFF_APT is a critical-severity malware/security problem. Lazarus and its sub-group Bluenoroff are state-sponsored advanced persistent threat (APT) actors. They target global financial institutions, SWIFT networks, cryptocurrency exchanges, and blockchain platforms using sophisticated custom malware, trojanized applications, and spear-phishing. It's also often linked to exploitation of public-facing server vulnerabilities. See the troubleshooting steps below for the fix.

Common Causes

• Spear-phishing emails targeting high-value corporate employees
• Downloading trojanized open-source utilities or crypto wallet apps
• Exploitation of public-facing server vulnerabilities

Step-by-Step Fix Guide

• 1
  Perform network-wide host and memory forensics to locate custom implants

  For lingering LAZARUS-BLUENOROFF-APT cases, "Perform network-wide host and memory forensics to locate custom implants" is worth running through.

• 2
  Enforce application control and code signing integrity policies

  "Enforce application control and code signing integrity policies" covers a less common but documented cause of LAZARUS-BLUENOROFF-APT.

• 3
  Revoke compromised administrative access and certificates

  "Revoke compromised administrative access and certificates" handles an edge case some users report with LAZARUS-BLUENOROFF-APT.

• 4
  Implement strict network segmentation for critical environments

  "Implement strict network segmentation for critical environments" handles an edge case some users report with LAZARUS-BLUENOROFF-APT.

Commands & Diagnostics

Frequently Asked Questions