Lazarus’ False Flag Malware

This report analyzes a sophisticated, multi-stage watering-hole campaign attributed to the Lazarus group that targeted Polish financial institutions; it describes exploited Flash/Silverlight components (cambio.swf), multi-stage shellcode delivery, backdoor binaries (fdsvc/fdsvc.dll, srsservice.*), C2 protocol details, transliterated Russian decoy strings (false flags), and provides MD5s, filenames and URL patterns as IOCs to aid detection and mitigation.