The APT known as Lazarus conducted spear phishing attacks with weaponized documents masquerading as Lockheed Martin. These weaponized documents perform a series of injections to achieve startup persistence on the victims system. As part of this killchain the Windows Update service is abused for payload execution and Github is utilzed as a C2 to deliver remote commands.
Malwarebytes researches have shared a full synopsis here:
MITRE ATT&CK Lazarus profile:
https://attack.mitre.org/groups/G0032/
Saint Paul City Council Extends Local State of Emergency to Respond to Digital Security Incident Article Link: https://www.stpaul.gov/news/saint-paul-city-council-extends-local-state-emergency-respond-digital-security-incident The Healthcare Industry Is at a Cybersecurity
U.S. Nuclear Weapons Department Compromised in SharePoint Attack Article Link: https://www.neowin.net/news/us-nuclear-weapons-department-compromised-in-sharepoint-attack/ Humans Can Be Tracked with Unique ‘Fingerprint’ Based on How Their Bodies Block Wi-Fi
