Lazarus_Group__2023__Kaspersky_cascade-of-compromise-unveiling-Lazarus-new-campaign_10-27-2023.pdf

Kaspersky describes a multi-wave Lazarus campaign that compromised software vendors via known/unpatched vulnerabilities to distribute SIGNBT (a memory-resident loader/backdoor) and LPEClient (victim profiling and in-memory payload delivery). The report details infection chains (phantom DLL hijacking and DLL side‑loading), SIGNBT C2 protocol and commands, deployment of additional in-memory tools and credential dumpers, MITRE ATT&CK mappings, and a comprehensive set of IOCs (file hashes, file paths, and C2 URLs) for detection and response.