Kaspersky · Published 21 Oct
Operation FlashHole: Lazarus breaks security, defies control
By Sojun Ryu
Excerpt
In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dub…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Kaspersky on securelist.com.
Mentioned in the excerpt1
More from Kaspersky8
Kaspersky · Web page · Published 28 Jul
Mirage Kitten targets Middle East and Africa region with new malware
Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and…
Kaspersky · Web page · Published 3 Jul
Armored Likho's new weapon: BusySnake Stealer
During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on…
Kaspersky · Web page · Published 17 Feb
Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores…
Kaspersky · Web page · Published 29 Dec
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
On the same topics
Malwarebytes · Web page · Published 5 Jan
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud,…
Malpedia · Web page · Added 18 Oct
Kazuar (Malware Family)
There is no description at this point. References 2026-06-25 ⋅ Google ⋅ Google Threat Intelligence Group The Latest Addition to Turla’s Intelligence Gathering Apparatus Kazuar 2026-05-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Kazuar: Anatomy of a…
Infosec Institute · Web page · Published 8 Jul
Animal Farm APT and the Shadow of French Intelligence
Almost every government is working to improve its cyber-capabilities. The majority of them already have in their arsenal powerful espionage malware and hacking platforms. We read about the techniques and tactics implemented by a number of APT groups from…
Darktrace · Web page · Published 3 Feb
Darktrace Malware Analysis: Unpacking SnappyBee
The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…