[Security Radar] North Korea's Lazarus Targets Defense Sector; U.S. Government Draws Companies Into Cyber Warfare

North Korea-linked hacking group Lazarus has been found to have approached people working in the defense and aerospace sectors with fake job offers, then exploited a Windows zero-day vulnerability during the attack. The group used malicious PDF files and a tampered viewer program as intrusion vectors to compromise victims' systems, and was later seen attempting privilege escalation to evade security detection. MS has released a security patch to fix the vulnerability.

The U.S. government has rolled out a new direction that allows private companies to carry out hacking operations under federal control while outlining a crackdown on cybercrime groups. The target is U.S. companies that pass a rigorous review, and they will be able to participate in activities such as accessing criminal organizations' systems, collecting intelligence, and disrupting related infrastructure, with a possible role in cyber operations.

Check Point Research announced on the 11th, local time, that North Korea-linked hacking group Lazarus had carried out attacks exploiting a zero-day vulnerability.

Check Point Research said Lazarus conducted the attack targeting the defense sector as an extension of its long-running 'Operation Dream Job.' The targets were organizations related to defense and aerospace, and the main focus was identified as aerospace and aviation organizations in Europe and India.

The attacker reportedly approached victims on LinkedIn and messengers by impersonating recruiters from well-known companies.

Check Point Research explained that there were two confirmed infection routes.

In the first infection route, victims were induced to download a legitimate PDF viewer and a malicious DLL at the same time, and then the group used DLL Side-Loading to run the malware 'MISTPEN.'

In one route, victims were led to a site impersonating a security company and installed a tampered PDF viewer called 'SecurityPDF.' That 'SecurityPDF' was designed to load the malware 'Troy' into memory when opening a PDF with a specific marker inserted. 'Troy' can carry out 17 commands, including file exploration, upload, download, and exfiltration.

What the two attacks had in common was the use of legitimate documents and programs as bait, followed by memory-based malware execution after reassuring the victim. This aligned with the goal of evading detection, and the multi-stage infection structure made it difficult for users to recognize that they had been infected.

After successfully infiltrating a system, the attackers could use the zero-day 'CVE-2026-68820' in the auxiliary function driver AFD.sys for WinSock to escalate limited privileges to administrator level. As a result of this privilege escalation, they could evade security software detection and interfere with logging.

Check Point reported the vulnerability to MS on the 28th of last month. MS fixed the vulnerability in its regular security update on the 11th of this month. CISA added CVE-2026-68820 to the KEV list the same day based on evidence of active exploitation.

The White House announced it on the 12th, local time, saying that President Donald Trump signed the NSPM to use private-sector capabilities and track and disrupt overseas cybercrime groups. The photo source is the official White House website.

The Trump administration has prepared a program for private companies that pass the review. The program will operate with participation under the command and supervision of the federal government.

The program targets overseas 'cyber-enabled transnational criminal organizations (CE-TCO).' The program involves private companies participating in cyber operations.

The program is operated by the NCC, and the DOJ and DHS each designate co-leads. Participating companies must, after passing review, meet requirements for signing contracts with the DOJ or DHS.

The permitted activities are divided into 'Cyber Surveillance Operations' and 'Cyber Effects Operations.' Cyber Surveillance Operations involve accessing overseas criminal organizations' systems and collecting information, while Cyber Effects Operations involve manipulating or disrupting information systems and networks, including degradation and destruction. As a result, the operations are aimed not merely at collecting information but at disrupting criminal infrastructure itself.

However, this does not grant private companies an independent 'Hack Back' authority. All operations are carried out under the federal government's legal authority and supervision, and written approval from the program lead is required before execution. In addition, if a mis-targeting incident occurs in which a U.S. person or information system in the United States is inadvertently targeted, the activity must be stopped immediately and the NCC must be notified.

The DOJ and DHS may require a security deposit or escrow of at least USD 1 million from participating companies as a contract condition. The U.S. government plans to establish operating procedures and criteria for participating companies within 60 days of the memorandum signing date.

This comes amid a situation in which the damage from internet crime is severe. According to FBI statistics, U.S. internet crime reports last year exceeded 1 million, and reported losses also surpassed USD 20 billion. Examples of internet crime include ransomware, phishing, and financial fraud.

At the same time, as the industrialization of overseas-based cybercrime advances, the U.S. government's response is focused on expanding the use of private technology and infrastructure. This measure follows that broader trend.

Against this backdrop, Cloudflare said in an announcement on the 13th, local time, that it blocked 935 DDoS attacks exceeding 1 Tbps on its network in the first half of this year. The 935 DDoS attacks above 1 Tbps in the first half represented a 519% increase from the previous quarter. The photo source is the Cloudflare blog.

Cloudflare announced on the 13th, local time, that it blocked 935 DDoS attacks exceeding 1 Tbps on its network in the first half of this year. Cloudflare also disclosed a total of 23.2 million network-layer DDoS attacks blocked in the first half, as well as a total of 29.64 trillion HTTP DDoS requests in the first half. The frequency of network-layer attacks was tallied at about 5,343 per hour, or about 128,000 per day.

By quarter, 2Q saw 805 DDoS attacks exceeding 1 Tbps, more than the 130 in 1Q, and the number of incidents in 2Q increased 519% from 1Q. In the first half, DNS-based attacks accounted for 34.3% of all network-layer attacks. The share of DNS flood attacks rose from 25.7% in 1Q to 40.0% in 2Q.

In addition, traffic amplification activity abusing exposed CLDAP services increased 580% from the previous quarter.

Not all DDoS attacks are the same. The first-half network-layer attack statistics showed that they do not all take the form of long-duration, large-scale traffic surges. Among first-half network-layer attacks, 96.62% were below 500 Mbps.

Attack duration was often not long, either. Among first-half network-layer attacks, 90.60% ended within 10 minutes. A massive attack observed by Cloudflare also ended in 35 seconds.

Attacks that concentrate massive traffic in a short time are difficult to defend against with only human alert review and manual response. In particular, while attack scale is expanding, the duration of attacks is showing a shortening trend.

For this reason, the importance of always-on DDoS defense systems that automatically detect and block attacks from start to finish is growing. The explanation is that the need for systems capable of automatic detection and blocking is expanding compared with methods that rely on human review before response.

Meanwhile, DLL Sideloading is a technique that induces a legitimate program to load a malicious DLL planted by an attacker when it runs. It exploits the execution process of legitimate programs and is used to evade malware detection.

One of the terms often mentioned in the cybersecurity field, a backdoor, refers to an abnormal channel for accessing a computer system or network by bypassing security authentication. A backdoor is described as a path used for additional attacks after intrusion.

A backdoor installation is a form of malware. Once installed, such a backdoor is used for command execution, file theft, and follow-on attacks.

Another term, Known Exploited Vulnerabilities (KEV), refers to a vulnerability list managed by CISA after confirming exploitation in cyberattacks. It is notable as a system for managing vulnerabilities that have actually been exploited.

U.S. federal agencies are required to take action on vulnerabilities listed in KEV within the deadline set by CISA. KEV is not merely an information list; it is operated as a framework that requires federal agencies to take action within a set period.

Hack Back refers to an organization's active response to an attack. Methods include infiltrating the attacker's systems and infrastructure, and the purpose is to track, block, or disrupt the attack.

However, U.S. law includes the CFAA. Because the CFAA defines punishable unauthorized access to computers and punishable system damage, any independent Hack Back by private companies in the United States could raise legal issues.

CLDAP stands for Connectionless Lightweight Directory Access Protocol, a connectionless lightweight directory access protocol. It is a communication method used for simple information queries and responses to internet-connected servers.

This characteristic allows an attacker who spoofs a victim address to cause simultaneous large-volume responses from multiple servers to be sent to the victim, and as a result it is abused to amplify DDoS traffic.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=241018

References

• https://www.itdaily.kr/news/articleView.html?idxno=241018