Lazarus_Group__2023__Ahnlab_Lazarus-using-public-certificate-vulnerability_02-27-2023.pdf

This AhnLab ASEC case report documents Lazarus Group activity using a zero-day vulnerability in widely used certificate software to achieve internal lateral movement in a financial organization, deploy backdoors (Keys.dat, Settings.vwx), disable the AhnLab V3 product via BYOVD techniques, and perform anti-forensic actions; the report provides timelines, malware filenames, driver abuse (PROCEXP152.SYS), multiple C2 IPs/domains, MITRE ATT&CK mappings, and hashes/IOCs for detection and response.