3 ms·
>One of these RATs is already known to be part of the Lazarus toolkit, specifically a variant of the BlindingCan backdoor with limited functionality but identic
by Thorrez 3y ago
>One of these RATs is already known to be part of the Lazarus toolkit, specifically a variant of the BlindingCan backdoor with limited functionality but identical command processing logic.
The attackers were using already known Lazarus malware. The researchers aren't simply basing the Lazarus attribution solely on an insider trading strategy or time zones.
- yieldcrv 3y agoalready known means everyone that knows can also do it
- stonepresto 3y agoThreat intel and analysis is just like any other analysis, it is taking a heuristic approach to finding answers. Can it be bypassed? Yes. Are the researchers whose entire company hinges on the correctness of their analysis doing their absolute best to attribute the attack to a threat actor? Yes. So to your point, somebody could indeed reuse malware or attempt to replicate it. However, the researchers are likely analyzing the disassembly and bytecode, and replicating complex malware to perfectly imitate a known family of malware is exceptionally difficult and statistically very unlikely. This is how threat intel is able to make any sort of claim of attribution.
- Thorrez 3y agoIn this case it was a modified version. Meaning the attackers have access to the source code. Not everyone has access to the malware's source code.