{
  "name": "Analysis of APT-C-26 (Lazarus) Group's Attack Campaign Using Remote IT Disguise to Deploy Monitoring Software",
  "slug": "analysis-of-apt-c-26-lazarus-groups-attack-campaign-using-remote-it-disguise-to-deploy-monitoring-software",
  "description": "The report details an attack campaign by APT-C-26 (Lazarus), a highly active APT group targeting various industries globally. The group deployed a customized monitoring program with remote desktop control capabilities, likely used by remote IT personnel infiltrating target companies. The malware consists of a registration program, a daemon process, and a DLL file for core monitoring functions. It utilizes Windows Shell extension for persistence and creates a covert remote desktop environment. The analysis reveals sophisticated techniques for evading detection, including disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data, uploads it to a server, and provides remote desktop functionality. Based on the analysis and tactics used, the activity is attributed to the Lazarus group.",
  "published": "2025-11-21T21:11:40+00:00",
  "created_at": "2025-11-21T21:11:40+00:00",
  "modified_at": "2025-11-21T21:36:08+00:00",
  "created_at_opencti": "2025-11-21T21:11:40+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-11-21",
    "apt",
    "monitoring software",
    "monitorinstaller_update1.exe",
    "north korea",
    "persistence",
    "remote desktop",
    "remote it",
    "screen capture",
    "systemuiext.dll",
    "winupdateservice.exe"
  ],
  "related_entities": {
    "intrusion_sets": [
      {
        "id": "01f86c99-f7a3-49ec-90da-f93f201fa5ce",
        "name": "APT-C-26 (Lazarus)",
        "slug": "apt-c-26-lazarus"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Aerospace"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://mp.weixin.qq.com/s/YzDg8MXiV6FhsiF7HWth4A?poc_token=HCzjIGmjFYvbkuW9wrpXCkYm_Yh3Ojib9Gv6B97t",
    "https://otx.alienvault.com/pulse/6920e39c52bbf117c94af4ba"
  ]
}