Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Lazarus Pakistan Toolkits refer to a set of malware tools attributed to the Lazarus Group, a well-known North Korean state-sponsored threat actor. These toolkits, identified around January 2019, include components such as PowerRatankba, a PowerShell-based malware installer, and keyloggers. PowerRatankba is a sophisticated malware family that leverages PowerShell scripts to execute payloads stealthily, often bypassing traditional detection mechanisms. The toolkits are believed to be used for espionage and cyber intrusion campaigns, with a focus on persistent access and data exfiltration. The mention of Pakistan in the context likely indicates targeting or operational infrastructure related to that region, though Lazarus is primarily linked to DPRK. The malware’s capabilities include keylogging to capture sensitive credentials and information, and the use of PowerShell installers suggests a reliance on living-off-the-land techniques, making detection and mitigation more challenging. The threat intelligence certainty is moderate (50%), and no known exploits in the wild have been reported, indicating that while the toolkits exist and are attributed to Lazarus, their active deployment or impact is not fully confirmed. The threat level is rated medium, reflecting the potential for espionage and data compromise but without evidence of widespread exploitation or destructive payloads.

Detailed information about 2019-01-25: Lazarus Pakistan Toolkits. Get real-time updates, technical details, and mitigation strategies.

2019-01-25: Lazarus Pakistan Toolkits - Live Threat Intelligence - Threat Radar | OffSeq.com

2019-01-25: Lazarus Pakistan Toolkits

2019-01-10: North Korea Lazarus Targeting REDBANC

The threat involves the North Korean state-sponsored threat actor group Lazarus targeting REDBANC, a financial network operator, as of January 2019. Lazarus is known for sophisticated cyber espionage and financially motivated attacks. This campaign employed a social engineering ruse involving job applications to establish a trusted relationship (MITRE ATT&CK T1199) with targets. The attackers leveraged PowerShell scripting (T1064) and Windows Management Instrumentation (WMI) (T1047) to execute malicious code and maintain persistence. They also used scheduled tasks (T1053) and the creation of new Windows services (T1050) to ensure continued access. The malware, identified as PowerRatankba, was designed to collect data from local systems (T1005) and exfiltrate it covertly over command and control (C2) channels (T1041), employing data encoding techniques (T1132) to evade detection. The attack chain indicates a focus on stealthy infiltration, persistence, data collection, and exfiltration, targeting Windows environments. Although no known exploits in the wild were reported at the time, the medium severity rating reflects the potential impact on confidentiality and integrity of sensitive financial data. The campaign's use of trusted relationships and scripting-based techniques highlights the sophistication and adaptability of Lazarus in targeting financial sector entities.

Detailed information about 2019-01-10: North Korea Lazarus Targeting REDBANC. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'actor: lazarus'

Filter Threats

Threats Tagged 'actor: lazarus'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility