Lazarus_Group__2020__ESET_Lazarus-supply-chain-attack-SouthKorea_11-16-2020.pdf

ESET documents a targeted supply-chain attack by the Lazarus APT in South Korea that leverages compromised websites using WIZVERA VeraPort to push signed, Themida-protected malware (multi-stage dropper → loader → downloader → RAT). The attackers used stolen code-signing certificates to bypass VeraPort signature checks, and the report includes detailed behavioral analysis, network C2 protocol artifacts, cryptographic routines, and extensive IoCs (file hashes, cert serials, C2 URLs, mutex) along with mitigation guidance such as enabling hash verification in VeraPort configurations.