Lazarus & Watering-hole attacks

ID: 0f25a2b4-6bfb-4f01-951e-6831ba6fbb5d

STIX ID: report--0f25a2b4-6bfb-4f01-951e-6831ba6fbb5d

Threat Score

75/100

Uploaded: 2026-08-15

Published Date: 2017-02-23

Last Modified Date: 2017-02-23

Created by: dogesec

TLP:CLEAR

ADMIRALTY:B2

PAP:CLEAR

...

This report describes a targeted watering‑hole campaign against banking and supervisory websites (notably knf.gov.pl, cnvb.gob.mx and brou.com.uy) delivering Silverlight/Flash exploits (CVE‑2016‑0034) and multiple malware samples linked to Lazarus tooling; it lists C2 IPs, MD5 hashes, compromised domains and recommended mitigations (patching and domain blocking).