Lazarus Group almost certainly connected to North Korea, Group-IB alleges

Threat intelligence agency Group-IB has published research indicating that the notorious Lazarus Group is well and truly connected to North Korea.

The group has been behind numerous attacks, including one that tried to steal US$1 billion from the Central Bank of Bangladesh. It compromised Polish banks in the process, and Group-IB says that attack was connected to Noth Korea.

The group was also behind the Sony Pictures hack in 2014, and numerous attacks on the South Korean Government.

Group-IB says that detailed analysis of the criminals' Command - Control (C-C) infrastructure and combined threat intelligence pinpointed the group's attacks to Pyongyang.

Further allegations also suggest that the group is controlled by Bureau 121, a division of North Korean intelligence agency Reconnaissance General Bureau.

Group-IB says that its report focused on infrastructure research, rather than malware analysis or attribution that previous reports have used.

The researchers found a 'complex' three-layer architecture, encrypted channels, VPN services and other techniques, but still managed to identify the group's operating location.

Group-IB co-founder and head of Threat Intelligence Department Dmitry Volkov, says the Lazarus Group is thorough and careful.

"Our research testified that North Korean Lazarus group is taking extraordinary precaution measures, dividing the attacks into several stages and launching all the modules manually. So that even if the attack is detected, it would take security researchers much time and effort to investigate it. To mask malicious activity, the hackers used a three-layer C-C infrastructure and pretended to be Russians," he explains.

The group has been using IP addresses across the world, including those of universities in the US, Canada, India and Great Britain, as well as pharmaceutical companies in Japan and China. They have also been using government subnets in various countries, Group-IB says.

"Taking into consideration strengthening economic sanctions against North Korea, as well as the geopolitical tension in the region, we expect a new wave of Lazarus attacks against global financial institutions. With that said, we strongly recommend the banks learn more about targeted attacks' tactics and techniques, increase corporate cybersecurity awareness, and cooperate with the companies providing relevant Threat Intelligence," Volkov adds.

Group-IB is a threat intellience provider with clients across the globe, including Fortune 500 companies in Asia and Australia.