The notorious APT hacking group “Lazarus” is behind two recent cyberattacks targeting two separate entities researching COVID-19. In one attack, a Ministry of Health entity was “infected” with malware. In the other attack, a different type of malware was used against a pharmaceutical company working on developing a vaccine for COVID-19.
The attacks, which were observed in the autumn of the current year, were detected by researchers at Kaspersky. Despite the use of different tactics, techniques and procedures (TTP) in each attack, the researchers have confidently assessed that both malicious activities are attributed to the hacking group “Lazarus”, which is said to be linked to South Korea.
Researchers found that on October 27, two Windows servers belonging to a Ministry of Health entity were infected with sophisticated malware, known as “wAgent.” Upon further analysis, it was determined that the malware used against the public health office had the same infection pattern as previous Lazarus attacks on cryptocurrency.
The attack on the pharmaceutical company took place on September 25. Researchers found that the hackers used Bookcode malware in a supply chain attack via a software . This type of malware has been previously reported by security firm ESET, which linked it to the hacking group Lazarus.
The Bookcode and wAgent malware have similar functionality – both have a full-featured backdoor. After deploying the final payload, the malware operator can take control of a victim's machine.
Seongsu Park, a security expert at Kaspersky, said that these two cyber attacks reveal Lazarus's interest in information related to COVID-19. He also added that while the hacking group is mainly known for its financial activities, it is now proven that it can «strike» and the strategic research.
Thus, Park issued a warning to all organizations working on research and combating the pandemic, noting the following: “We believe that all entities currently involved in activities such as vaccine development or crisis management must be on alert for possible cyberattacks.
