Lazarus Hijacks Windows Update Client

Lazarus cybercrime group ties to the North Korean government is a well known one, now it has managed to abuse the Windows Update Client to distribute malware.

The researchers said they were investigating a phishing campaign impersonating Lockheed Martin, an American aerospace, arms, defense, information security, and technology corporation.

Advertisements

The group was distributing two files targeting people interested in getting a job at the company.

Lockheed_Martin_JobOpportunities.docx
Salary_Lockheed_Martin_job_opportunities_confidential.doc

The documents themselves carried malicious macros which, if activated, drop a WindowsUpdateConf.lnk file in the target endpoint’s startup folder, and a DLL file (wuaueng.dll) in the Windows/System32 folder.

The .lnk file launches the Windows Update Client which, in turn, launches the malicious DLL. This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client, to bypass antivirus solutions and other security mechanisms.

The threat actor can execute its malicious code through the Microsoft Windows Update client by passing the following arguments: /UpdateDeploymentProvider, Path to malicious dll and /RunHandlerComServer argument after the dll.