ctrlINT What the industry said about every indicator, with the quote

DRATzarusMalware

  • ThreatNeedle
  • threatneedletea

DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.From MITRE ATT&CK

Last reported 4 days ago, by Kaspersky Securelist1 report

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Note that we have reclassified the ThreatNeedle variant used in Operation SyncHole as the latest version of IMETHOD, the predecessor of ThreatNeedle in use since at least 2016.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with DRATzarus here?
No account needed. We do not store your IP address.