Lazarus Hackers Target Linux, Windows With New Dacls Malware

guest · Dec 17, 2019

Lazarus Hackers Target Linux, Windows With New Dacls Malware
December 17, 2019
https://www.bleepingcomputer.com/ne...-target-linux-windows-with-new-dacls-malware/

A new Remote Access Trojan (RAT) malware dubbed Dacls and connected to the Lazarus Group has been spotted by researchers while being to target both Windows and Linux devices.
First Linux malware linked to Lazarus
While they are known for targeting both Windows [1, 2, 3] and macOS [1, 2] targets, this is the first time they are connected to malware capable of infecting and abusing Linux devices.

"At present, the industry has never disclosed the Lazarus Group's attack samples and cases against the Linux platform," the Qihoo 360 Netlab researchers state.
Modular and cross-platform RAT
The malware is modular and it is capable of dynamically loading plug-ins remotely on compromised Windows servers, while the Linux version bundles all the plug-ins it needs to function within the bot component.

[...] the CVE-2019-3396 RCE bug.
This hints at the Lazarus Group hacking outfit potentially using the CVE-2019-3396 vulnerability to spread Dacls malware payloads on unpatched Confluence servers.
Click to expand...

Qihoo 360 Netlab: Dacls, the Dual platform RAT

guest · May 6, 2020

Lazarus Group Hides macOS Spyware in 2FA Application
The Dacls RAT has been ported from an existing Linux version
May 6, 2020
https://threatpost.com/lazarus-macos-spyware-2fa-application/155532/

The North Korea-linked cyberthreat group known as Lazarus Group has added a new variant of the Dacls remote-access trojan (RAT) to its arsenal of spy gear, designed specifically for the Mac operating system.
Initial Installation
Taking a closer look at the malware, the malicious Mac executable is located in “Contents/Resources/Base.lproj/” directory of the fake application and pretends to be a nib file, according to researchers at Malwarebytes, in a posting on Wednesday.
The malware also has a configuration file, encrypted with AES, that pretends to be a database file related to the Apple Store, “Library/Caches/Com.apple.appstore.db.”

“The config file is constantly updated by receiving commands from the C2 server,” according to Malwarebytes.
Information Harvesting
It also loads seven modules, six of which are also present in the Linux variant. [...]
Click to expand...

Malwarebytes: New Mac variant of Lazarus Dacls RAT distributed via Trojanized 2FA app

We recently identified what we believe is a new variant of the Dacls Remote Access Trojan (RAT) associated with North Korea’s Lazarus group, designed specifically for the Mac operating system.
Dacls is a RAT that was discovered by Qihoo 360 NetLab in December 2019 as a fully functional covert remote access Trojan targeting the Windows and Linux platforms.

This Mac version is at least distributed via a Trojanized two-factor authentication application for macOS called MinaOTP, mostly used by Chinese speakers. Similar to the Linux variant, it boasts a variety of features including command execution, file management, traffic proxying and worm scanning.
Click to expand...

Log in or Sign up

Lazarus Hackers Target Linux, Windows With New Dacls Malware

guest Guest

guest Guest

Log in or Sign up

Lazarus Hackers Target Linux, Windows With New Dacls Malware

guest Guest

guest Guest

Useful Searches