Lazarus_Group__2019__sentinel-one-sentine-6.pdf

SentinelLabs presents a technical analysis of the Anchor project, a modular evolution of TrickBot that functions as an all-in-one attack framework for enterprise environments; the report details installer/deinstaller components, bot behaviour, loaders (Meterpreter/Metasploit, CobaltStrike, Terraloader), a POS-focused memory scraper (Memscraper) with HTTP and DNS exfiltration, PowerShell-based delivery chains, PDB artifacts, and numerous IOCs and YARA rules, and notes overlaps with known APT tooling (e.g., PowerRatankba/Lazarus) raising attribution questions.