MalwarePublished 24 Apr 2024Updated 30 Jul 2025

OSINT · Potential abuse by Lazarus group using LinkedIn to spread malware

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Potential abuse by Lazarus group using LinkedIn to spread malware

Impact

For European organizations, the potential impact includes unauthorized access to sensitive corporate data, intellectual property theft, espionage, and disruption of business operations. The use of a RAT like Nukesped enables attackers to maintain persistent access, conduct reconnaissance, and exfiltrate data stealthily. This can lead to significant financial losses, reputational damage, and regulatory penalties, especially under GDPR for data breaches. Employment and recruitment sectors are particularly vulnerable due to the nature of their communications and the high volume of external contacts via LinkedIn. The stealthy nature of the malware and the social engineering approach increase the risk of successful compromise. Additionally, the geopolitical context of North Korean threat actors targeting European entities may escalate tensions and prompt increased scrutiny from national cybersecurity agencies. The lack of known exploits in the wild currently limits immediate widespread impact but does not reduce the potential for targeted, high-value attacks.

Defensive guidance

1. Implement advanced email and social media filtering solutions that can detect and block malicious links and attachments on LinkedIn and other platforms. 2. Conduct targeted user awareness training focused on recognizing social engineering tactics specific to professional networking sites. 3. Enforce strict application whitelisting and endpoint protection to prevent execution of unauthorized binaries like RATs. 4. Monitor network traffic for unusual outbound connections indicative of RAT command and control communications. 5. Leverage threat intelligence sharing platforms to stay updated on emerging indicators related to Lazarus group activities. 6. Employ multi-factor authentication (MFA) on all corporate accounts, including LinkedIn, to reduce account compromise risks. 7. Regularly audit and restrict permissions for third-party applications integrated with LinkedIn to minimize attack surface. 8. Establish incident response playbooks that include scenarios involving social media-based malware delivery. 9. Collaborate with LinkedIn’s security team to report suspicious accounts and messages promptly. 10. Use sandboxing technologies to analyze suspicious files or links received via LinkedIn before allowing user access.

Indicators of compromise

Hashes 21

7a5a694ac7d4068f580be624ece44f4f
aad9dcd3a2045dafea47eef776ec5b8a
53ec27df858d3d133808ec338df29fc6
e6d09c7ad340d10109e6781bfb05a319
f1b78698b108fbf5bfcbb6d7f3bbad76
fa174cdd22080f11e13844c1e3326cd2
97868b884fc9d01c0cb1f3fa4d80b09f
d3a85f6ccf117fb1cdb506094edddd22
46b2cfef633e6e531928a9c606b40b16
7a5a694ac7d4068f580be624ece44f4f

Text 7

#Lazarus #APT The Lazarus group appears to be currently reaching out to targets via LinkedIn and spreading malware https://stackoverflow.com/questions/78328188/scam-js-code-does-this-script-install-anything-malicious-locally-if-i-ran-it-wi IOC : https://pastebin.com/2pz1iQFm
asdasd13asbz
asdasd13asbz
5/63
5/63
14/62
7/63

Link 7

https://twitter.com/asdasd13asbz/status/1782951380568936481
https://stackoverflow.com/questions/78328188/scam-js-code-does-this-script-install-anything-malicious-locally-if-i-ran-it-wi
https://pastebin.com/2pz1iQFm
https://www.virustotal.com/gui/file/c09271054916807f78795a7440c6223d05c6dd543b97fd3a32aa44b1e8dc658e
https://www.virustotal.com/gui/file/1e959131e5964fc47b468bd5b920221a418b660898a692215ee996452d0b741a
https://www.virustotal.com/gui/file/5cc1493357886c767354f152b940d63991f07a5010f22a46e8a514a08fbe3b18
https://www.virustotal.com/gui/file/f790ad0bfe7a465805b44264c88588e70eb3200806ac290150205a57d28d6b1a

File 10

GL5Qx1MboAAZwsk.png
Archive.zip
E.zip
cryptoPriceMonitoringSite-main.zip
dev_now_gold.zip
purchased-casino-template-master.zip
server.zip
test_interview.zip
test-project.zip
test-task.zip

Tlsh 4

t181a21a7d862c1d56eb425279db828b4c92c7480253d7298ff794a80c9b6f1c4eb3f687
t1ebc633e9d60afd13cfb330fd15232197d62b403a04d93a0e6ae7275849a7e716b481b7
t19192e10892fa3a12e6a9ea3ceeaa7a77dfc4c76013219b371c155f40bd614731786748
t157c41251e02b4921e74fb73e68c54b79f1a8c75941b8fa1716d3e0d2c80a9ea0e53e0f

Vhash 4

8ea2b911231296d0b157663c9925747a
368ee962ab7ee47e59e1451977b49a53
44a94cf9b723ba33e3c34a03cbf30a77
a3db384a0b424982d7ba1e63c5ce7c17

Ssdeep 4

384:DlV7q4PW1bzAhWoiqy6F2Axnyrk/YnW2xXsju46qXAEVsbYIGiXsrJ9ZjadxNtTf:GfbzAhWoiq1Ffsn462hi8rPxWL
196608:/TiGy2glm8hpEs6nfk3VXPsI7wSAcGqO2glnHXLN++37gD8MumWhIIIDizJBbEQ:+XXxhL2sF/siwSAcq2gZ35++LpMumWKA
384:i/3WEvsdCWlcn8IKO/XE6nvmjFAHl9/xsazRDtQYBrpP:6UCW50XQWFVx9zRhzr1
12288:WPG0mF7+lXnIxgscWkYfdiDUZzCdbq8N8Eu:R5F7eXnLscWkkPybq8Nju

Community reviews

Loading reviews…