Kaspersky finds Lazarus employs multi-platform malware framework in series of data espionage and ransomware attacks

Kaspersky researchers have uncovered a series of attacks that use an advanced malware framework, MATA, to target Windows, Linux and macOS operating systems. In use since spring 2018, the framework is linked to Lazarus, a well-known and prolific North Korean APT group.

Malicious toolsets used to target multiple platforms are a rare breed as they require significant investment from the developer. They are often deployed for long-term use, which results in increased profit for the actor through numerous attacks spread over time. In the cases discovered by Kaspersky, the MATA framework was able to target three platforms, Windows, Linux and macOS, indicating that the attackers planned to use it for multiple purposes. The framework consists of several components including a loader, an orchestrator and plugins.

According to Kaspersky researchers, the first artefacts found relating to MATA were used around April 2018. Since then, the actor behind this advanced malware framework has taken an aggressive approach to infiltrate corporate entities around the world. It was utilized for a number of attacks aimed at stealing customer databases and distributing ransomware.

According to Kaspersky telemetry, victims infected by the MATA framework were located in Poland, Germany, Turkey, Korea, Japan and India, indicating that the threat actor was not focusing on a specific territory. Moreover, Lazarus compromised systems in various industries including a software development company, an e-commerce company and an internet service provider.

Kaspersky researchers were able to link MATA to the Lazarus group, known for its sophisticated operations and links to North Korea, and for cyberespionage and financially-motivated attacks. A number of researchers, including those at Kaspersky, previously reported on this group targeting banks and other large financial enterprises including the ATMDtrack attack and AppleJeus campaigns. This latest series of attacks suggests that the actor is continuing this type of activity.

Victims of MATA framework are located across the world

“This series of attacks indicates that Lazarus was willing to invest significant resources into developing this toolset and widening the reach of organizations targeted, particularly in hunting for both money and data,” said Seongsu Park, a senior security researcher at Kaspersky. “Furthermore, writing malware for Linux and macOS systems often indicates that the attacker feels that he has more than enough tools for the Windows platform, which the overwhelming majority of devices are run on. This approach is typically found among mature APT groups. We expect the MATA framework to be developed even further and advise organizations to pay more attention to the security of their data, as it remains one of the key and most valuable resources that could be affected.”

In order to avoid falling victim to multi-platform malware, Kaspersky researchers recommend implementing the following measures:

• Install a dedicated cybersecurity product on all Windows, Linux and MacOS endpoints, such as Kaspersky Endpoint Security for Business. This will enable protection from existing and new cyberthreats and also provides a range of cybersecurity controls for each operating system 
• Provide your SOC team with access to the latest Threat Intelligence to help them stay up to date with any new and emerging tools, techniques and tactics used by threat actors

• Always have fresh back-up copies of business data that are quickly accessible, so you can urgently recover data that may be lost or locked due to ransomware

For more information about the MATA framework, please visit Securelist.

About Kaspersky

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at usa.kaspersky.com.