Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points

AhnLab Security Emergency response Center (ASEC) has discovered that Lazarus, a threat group deemed to be nationally funded, is attacking Windows Internet Information Service (IIS) web servers and using them as distribution points for their malware.

The group is known to use the watering hole technique for initial access. [1] The group first hacks Korean websites and modifies the content provided from the site. When a system using a vulnerable version of INISAFE CrossWeb EX V6 visits this website via …

ahnlab asec center distribution emergency iis information internet lazarus malware malware analysis malware distribution response security servers service threat threat group watering hole web windows