WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf

WithSecure's 'No Pineapple' report documents a Q4 2022 DPRK-attributed intrusion (Lazarus Group) that exploited Zimbra vulnerabilities to gain initial access to medical research, energy, and supply-chain targets; operators deployed webshells, tunnelling/proxy tools (Plink, 3Proxy, Stunnel), and malware including Dtrack, GREASE, and a QT-based backdoor (acres.exe), used Impacket for remote execution and Mimikatz for credential theft, and exfiltrated roughly 100 GB of data while exhibiting nation-state TTPs and operational patterns consistent with UTC+9 working hours.