Unlike previous iterations that used the password “1234qwer,” the latest variant employs “2345rdx” as its authentication mechanism, indicating an evolution in their operational security measures. The continued evolution of Lazarus techniques underscores the importance of proactive security measures against this persistent advanced threat actor targeting critical infrastructure worldwide. These web shells utilize sophisticated obfuscation techniques, remaining encoded in VBE format even after initial decoding, making detection and analysis challenging for security teams. Commands include “MidRequest” for redirecting data, “ProxyCheck” for saving Mid Info, “ReadFile” and “WriteFile” for file operations, “ClientHello” for responding with Mid Info, and others that facilitate the attackers’ control over the compromised system. Further security is implemented through random strings such as “xdmCz1eQ:?EkQ0d%c%r%jgY!fjabTTA0” and “#N@BGjn8g5!yCJAfiEFzq04Cqr%dFvcX” for the respective web shells. The threat actors have been breaching IIS servers to deploy ASP-based web shells, which are subsequently used as first-stage Command and Control (C2) servers that proxy communications to second-stage C2 infrastructure. Security researchers advise administrators to thoroughly inspect their web servers for vulnerabilities that could enable file uploads, particularly focusing on ASP-based web shells. These attacks, identified in January 2025, represent an evolution of similar techniques observed in May 2024, signaling persistent and adaptive tactics from this state-sponsored threat group. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The malware uses commands like “rundll32.exe C:\ProgramData\USOShared\sup.etl,SerializeMarketTable_32 x9nsB3iYUWiDT6BZKO5pgtMW -v 62 -m D:/www/[path]/ac_lst.exe” to execute privilege escalation. Regular updates to security solutions like V3 are recommended to ensure the detection of known Lazarus group indicators of compromise. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Mar 2025 11:20:06 +0000