Lazarus Targets Chemical Sector With Dream Jobs, Then Trojans

Chemical companies are the latest to be targeted by the well-known North Korean group, which has targeted financial firms, security researchers, and technology companies in the past.

The North Korean-linked Lazarus group sent fake job offers to targets in the chemical sector and information technology firms, which — when opened — install Trojan horse programs to collect information and send it back to the attackers, technology provider Broadcoms security arm Symantec stated in an advisory on April 14.
The attack is part of a long-running campaign — dubbed Operation Dream Job — that sends targets in specific industries malicious Web files disguised as job offers, which when opened attempts to compromise the system. While the current set of attacks focuses on South Korean chemical companies and their IT service providers, other targets have included industries and government agencies in Europe, Asia, and the United States. This campaign marks a shift, as Lazarus in the past targeted the defense, government, and engineering sectors.
The attacks have, at various times, targeted defense contractors, engineering firms, government agencies, and even pharmaceutical companies during the height of the pandemic, says Dick O’Brien, principal intelligence analyst for Symantecs threat-hunting team.
North Korea-linked attackers have a long history of targeting intellectual property, presumably to assist strategically important engineering or technology projects, he says, adding: Across all attacks, we’ve seen a range of data theft [and] data exfiltration tools deployed on infected computers. We’re assuming that they take what they need before moving on.
Other security and technology firms have also documented Lazaruss involvement in Operation Dream Job, which some researchers track as Operation AppleJeus. In early 2021, the Lazarus group targeted security researchers with
similar offers of high-level jobs in the industry
. And, earlier this year, the attackers targeted more than 250 individuals working for news media, software vendors, and Internet infrastructure providers, using job offers that appeared to come from Disney, Google, and Oracle, according to Google, which tracked the campaign.
A related campaign targeted cryptocurrency and financial technology and services firms, Adam Weidemann, a researcher with Googles Threat Analysis Group,
stated in a late March blog post
.
We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques, he wrote. It is possible that other North Korean government-backed attackers have access to the same exploit kit.
Long-Running Campaign
The April 14 advisory from Symantec noted that the campaign started at least as early as August 2020, albeit with a different set of targets. While the current campaign targets the chemical sector, campaigns discovered in 2020 had focused on government agencies and defense contractors, the company
stated in its advisory
.
Operation Dream Job involves Lazarus using fake job offers as a means of luring victims into clicking on malicious links or opening malicious attachments that eventually lead to the installation of malware used for espionage, the company said.
Symantecs threat team outlined the steps in a successful attack in January 2022, which completed less than four days after the target received the file until the final execution of a program that collected and exfiltrated system data. After the targeted user opened the fake job offer, the attack exploited a vulnerability in one of two software packages, the INISAFE Web EX Client for system management or MagicLine, a gym management program, says Symantecs OBrien.
They’re not household names for us but our working assumption is they’re widely used in the industry or sector they’re currently targeting, he says. An alternative hypothesis is they installed the software themselves in order to inject into it, but we haven’t seen any evidence of that.
While companies not running either application may not have to worry about this particular attack, cyber-espionage groups such as Lazarus are very good at tailoring attacks to match their targets environment, he says.
For that reason, no single solution will help prevent cyber-espionage attacks, OBrien stressed. Instead, companies should take a layered approach to defense, using network detection, endpoint security, and hardening technologies — such as multifactor authentication — to protect against multiple vectors of attack, he says.
We’d also advise implementing proper audit and control of administrative account usage, [and] you could also introduce one-time credentials for administrative work to help prevent theft and misuse of admin credentials, OBrien says. We’d also suggest creating profiles of usage for admin tools, [because] many of these tools are used by attackers to move laterally undetected through a network.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Lazarus Targets Chemical Sector With Dream Jobs, Then Trojans