Lazarus_Group__2022__Ahnlab-Lazarus-attack-group-exploits-INITECH-process_04-18-2022.pdf

An AhnLab technical analysis describes a Lazarus Group campaign in early 2022 that abused the INITECH INISAFE CrossWeb EX process by injecting SCSKAppLink.dll into the signed inisafecrosswebexsvc.exe binary to download and execute additional malware; ~47 organizations including defense and chemical sector companies were impacted and the report exposes MD5 hashes and C2/URL IOCs.