The GDPR Playbook: Discover, Plan, and Act on the Upcoming EU Data Protection Regulation

Proofpoint analysis attributes an extensive, financially motivated Lazarus Group campaign to a new PowerShell downloader family (PowerRatankba) and related tools (PowerSpritz, Gh0st RAT, RatankbaPOS). The campaigns use diverse delivery methods—spearphishing, LNK/CHM/JS downloaders, macro-laden Office documents, and backdoored PyInstaller installers mimicking cryptocurrency wallets—to steal cryptocurrency credentials and scrape POS track data (South Korea), with extensive IOCs and C2 details provided.