Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America

**Executive summary:** Trend Micro describes a September 2018 Lazarus/Bluenoroff campaign that installed a modularized backdoor on financial institution systems in Latin America using a service-launched loader (AuditCred.dll/ROptimizer.dll) which decrypts an in-memory backdoor (Msadoz<n>.dll) and an encrypted .mui configuration to retrieve C2 addresses; the backdoor supports file discovery, download, process management, code injection, proxying and both active and passive command channels, and the report includes C2 IPs and mitigation recommendations.