Lazarus_Group__2018__Lazarus_Campaign_Targeting_Cryptocurrencies.pdf

Trend Micro analyzes a Lazarus group campaign that uses a PowerShell-based RATANKBA backdoor delivered via malicious Microsoft Office documents, CHM files and script downloaders (cryptocurrency-themed lures). The backdoor communicates with a controller/C2 via HTTP to receive tasks (command execution, DLL injection, interval changes, kill) and upload victim data; researchers recovered backend logs, attacker profiles tied to Korean-language users and cryptocurrency transactions, and published IoCs (hashes) plus defensive mitigations.