Lazarus rising: North Korean state hackers focused on IT supply chain

Published 11/4/21, 9:00am

The state-sponsored North Korean criminal gang known as Lazarus is redirecting and expanding efforts on supply chain attacks according to industry security researchers. Using a new variant of the BLINDINGCAN backdoor (identified in August 2020 by CISA and the FBI), the threat has capabilities that include removing itself from compromised systems to evade detection, spawning and kill processes, file tampering, and data exfiltration. 

Also tracked as Hidden Cobra, the Lazarus group is a military hacking group sponsored by the North Korean government (officially known as the Democratic People’s Republic of Korea (DPRK)). Attacks involve carefully constructed, multi-stage processes using several layers of command and control (C2) servers. 

Next Steps

To protect against BLINDINGCAN attacks, cybersecurity experts and the FBI advise organizations to follow cybersecurity best practices including:

• Maintain up-to-date security
• Update and patch system and software quickly.
• Use multi-factor authentication
• Apply least privilege