The APT known as Lazarus conducted spear phishing attacks with weaponized documents masquerading as Lockheed Martin. These weaponized documents perform a series of injections to achieve startup persistence on the victims system. As part of this killchain the Windows Update service is abused for payload execution and Github is utilzed as a C2 to deliver remote commands.
Malwarebytes researches have shared a full synopsis here:
MITRE ATT&CK Lazarus profile:
https://attack.mitre.org/groups/G0032/
Passkey-Themed Phishing Attacks Lead to Microsoft 365 Data Theft Article Link: https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/ What does this mean for me? Florida DMV Database Breached Through Stolen Police
Red Flags That Expose Fake North Korean IT Workers Article Link: https://www.darkreading.com/insider-threats/red-flags-expose-fake-north-korean-it-workers What does this mean for me? Fake Voicemail SVG Attachments Fuel Large-Scale Phishing
