Lazarus Group Exploiting ManageEngine Flaw and Attacking Internet Backbone Infrastructure: Analysis of the QuietRAT Malware

The Lazarus Group, a renowned state-sponsored threat actor backed by North Korea, continues to pose a significant cybersecurity threat. In recent findings, security analysts at Cisco Talos have confirmed that the Lazarus Group is actively exploiting the ManageEngine flaw (CVE-2022-47966) to deploy the MagicRAT malware. Additionally, in Europe, the Lazarus Group targeted an internet backbone infrastructure provider, deploying the QuiterAT malware. This article aims to delve into the intricacies of these attacks, shed light on QuiterAT’s characteristics and connections to MagicRAT, and analyze the significance of QuiterAT’s emergence.

Lazarus Group Exploiting ManageEngine Flaw

The cybersecurity community was alerted when Cisco Talos shared their report on the Lazarus Group’s exploitation of the ManageEngine flaw. The flaw (CVE-2022-47966) allows the threat actor to gain unauthorized access and deploy the MagicRAT malware. This state-sponsored group utilizes advanced techniques to infiltrate targeted systems and exfiltrate sensitive information.

Attack on Internet Backbone Infrastructure in Europe

Adding to their aggressive activities in Europe, the Lazarus Group launched an attack on an internet backbone infrastructure provider in early 2023. Their primary objective was to deploy the QuiteRAT malware. This attack raises concerns about the potential disruption of critical internet services and highlights the audacity of the Lazarus Group.

Overview of QuiteRAT

QuiteRAT, an evolution of the notorious MagicRAT, is a Remote Access Trojan (RAT) that incorporates Qt libraries without a Graphical User Interface (GUI). This lightweight malware shrinks down to merely 4-5MB, in contrast to the bulkier 18MB MagicRAT, by utilizing fewer Qt libraries. This reduction in size allows the Lazarus Group to deploy it more discreetly and evade detection.

Given the similarities in traits, QuiteRAT is considered to be closely connected to the MagicRAT family. Both malware variants share their Qt framework roots, command execution capabilities, string obfuscation techniques, and sleep functionality. These common characteristics strongly indicate QuiteRAT’s roots in MagicRAT.

Networking Settings and Encryption in QuiteRAT

To ensure the security of their Command-and-Control (C2) communications, QuiteRAT leverages XOR (0x78) and base64 encoding techniques to encode strings containing C2 URLs and extended URI parameters. This approach not only obfuscates the malicious traffic but also obstructs analysis and detection by security solutions.

Latest Version and Evolution of MagicRAT

The most recent version of MagicRAT was identified in the wild in April 2022. Since then, the Lazarus Group has been evolving their tactics with the emergence of QuiteRAT. This new iteration represents a strategic shift towards a smaller Qt-based approach, allowing the threat actors to maximize their operational efficiency and increase the chances of successful infiltration.

Significance of QuiteRAT’s Emergence

The emergence of QuiteRAT in May 2023 signifies the Lazarus Group’s adaptive nature and their commitment to staying one step ahead of cybersecurity defenses. By utilizing a lightweight RAT with reduced dependencies on Qt libraries, the group aims to enhance their stealth and minimize the footprint of their malicious activities. This highlights the need for constant vigilance and strengthened defenses against state-sponsored threat actors.

The Lazarus Group, with backing from North Korea, remains a dangerous adversary in the world of cybersecurity. Their recent activities, including the exploitation of the ManageEngine flaw and attacks on internet backbone infrastructure, demonstrate their ongoing threat to critical entities across Europe and the United States. The emergence of QuiteRAT, an evolution of MagicRAT, signifies the group’s adaptability and determination to refine their tactics. It is crucial for organizations to maintain robust cybersecurity measures, keep their systems up to date, and engage in continuous monitoring to detect and mitigate the risks posed by state-sponsored threat actors like the Lazarus Group.

Explore more

Why is LinkedIn the Go-To for B2B Advertising Success?

In an era where digital advertising is fiercely competitive, LinkedIn emerges as a leading platform for B2B marketing success due to its expansive user base and unparalleled targeting capabilities. With over a billion users, LinkedIn provides marketers with a unique avenue to reach decision-makers and generate high-quality leads. The platform allows for strategic communication with key industry figures, a crucial

Endpoint Threat Protection Market Set for Strong Growth by 2034

As cyber threats proliferate at an unprecedented pace, the Endpoint Threat Protection market emerges as a pivotal component in the global cybersecurity fortress. By the close of 2034, experts forecast a monumental rise in the market’s valuation to approximately US$ 38 billion, up from an estimated US$ 17.42 billion. This analysis illuminates the underlying forces propelling this growth, evaluates economic

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Embedded Finance Ecosystem – A Review

In the dynamic landscape of fintech, a remarkable shift is underway. Embedded finance is taking the stage as a transformative force, marking a significant departure from traditional financial paradigms. This evolution allows financial services such as payments, credit, and insurance to seamlessly integrate into non-financial platforms, unlocking new avenues for service delivery and consumer interaction. This review delves into the

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.