Lazarus Group APT Targeting South Korean Users

Zscaler ThreatLabz documents a year-long spear-phishing campaign targeting users in South Korea that uses CHM and macro-laden documents to deploy a multi-stage dropper and payload (drops IntelRST.exe, retrieves C2 info from attacker-controlled Dropbox, and exfiltrates machine identifiers); researchers correlate reused infrastructure, passive DNS, and registrant data to attribute the activity with high confidence to the Lazarus APT and publish numerous IoCs (file hashes, domains, IPs, emails, PDB path).