BAE Systems Threat Research Blog: Lazarus’ False Flag Malware

BAE Systems Threat Research documents a sophisticated, multi‑stage watering‑hole campaign attributed to the Lazarus group that targeted financial institutions (notably Polish banks) by chaining JBoss site compromise, profiling JavaScript, and serving Flash/Silverlight exploits which load staged shellcode and ultimately deploy backdoors; the analysis includes reverse engineering of binaries, C2 protocol and keys, transliterated Russian false‑flag artifacts, and a set of IOCs (MD5 hashes, filenames, URLs).