BAE Systems Threat Research Blog: Lazarus & Watering-hole attacks

BAE Systems analyses a campaign of watering‑hole attacks that compromised bank supervisory and bank websites (notably knf.gov.pl, www.cnbv.gob.mx and others) to serve Silverlight/Flash exploits (CVE‑2016‑0034) and deliver malware; the report includes malware/sample analysis (packed with Enigma Protector, double‑RC4 decryption), MD5 hashes, C2 IP addresses, and global IP whitelists targeting financial institutions, and recommends applying patches and blocking compromised domains.