North Korea-linked APT Lazarus targets security researchers using a trojanized pirated version of the popular IDA Pro reverse engineering software.

ESET researchers reported that the North Korea-linked Lazarus APT group is targeting cyber security community with a trojanized pirated version of the popular IDA Pro reverse engineering software.

Threat actors bundled the IDA Pro 7.5 software with two malicious components.

“Attackers replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL. The malicious win_fw.dll creates a Windows scheduled task that starts a second malicious component, idahelper.dll, from the IDA plugins folder.” reads the tweet published by ESET.

#ESETresearch discovered a trojanized IDA Pro installer, distributed by the #Lazarus APT group. Attackers bundled the original IDA Pro 7.5 software developed by @HexRaysSA with two malicious components. @cherepanov74 1/5 pic.twitter.com/WEAJz4Gxpi— ESET research (@ESETresearch) November 10, 2021

IDA Pro is widely used by malware researchers to translate machine-executable code into assembly language source code for purpose of debugging and reverse engineering. 

Upon executing the installer, the idahelper.dll attempts to download and execute a next-stage payload from https://www[.]devguardmap[.]org/board/board_read.asp?boardid=01.

Experts pointed out that the domain was involved in a past campaign carried out by the APT group and aimed at security professionals. In March, researchers from Google’s Threat Analysis Group (TAG) reported that North Korea-linked hackers are targeting security researchers via social media.

Google researchers discovered that threat actors also created a website for a fake cybersecurity firm named SecuriElite offering offensive security services, including pentests, security assessments, and exploits.

IoCs : win_fw.dll A8EF73CC67C794D5AA860538D66898868EE0BEC0 idahelper.dll DE0E23DB04A7A780A640C656293336F80040F387 : Win32/NukeSped.KZ Win64/NukeSped.JS : devguardmap[.]org #ESETresearch 5/5— ESET research (@ESETresearch) November 10, 2021The activity of the Lazarus APT group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks. This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems.

The group is considered responsible for the massive WannaCry ransomware attack, a string of SWIFTattacks in 2016, and the Sony Pictures hack.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, Operation Cyclone)

The post North Korea-linked Lazarus group targets cybersecurity experts with Trojanized IDA Pro appeared first on Security Affairs.