Lazarus_Group__2016__Novetta_Operation-Blockbuster-Report_Feb-24-2016.pdf

Operation Blockbuster is a Novetta-led technical investigation attributing a wide set of malware families and campaigns to the Lazarus Group. The report links the Sony Pictures Entertainment (SPE) destructive wiper to over 45 malware families (RATs, loaders, spreaders, DDoS bots, wipers) via shared code, cryptographic keys, and libraries; documents TTPs such as fake-TLS, dynamic API loading, and secure file deletion; enumerates infrastructure and P2P staging; provides IoCs (hashes, YARA rules) and historical campaign correlations (Operation Troy, DarkSeoul, Ten Days of Rain); and offers remediation guidance.