BleepingComputer reports that Andariel, a sub-group of North Korean state-sponsored hacking operation Lazarus Group, has leveraged the newly discovered EarlyRAT malware in attacks abusing the Log4Shell vulnerability last year. Network reconnaissance, credential theft, and lateral movement activities following Log4Shell exploitation were facilitated by Andariel, also known as Stonefly, through the Powerline, Putty, Dunpert, and 3Proxy tools, while macros in the operation’s phishing document enabled EarlyRAT payload retrieval from a server previously used in Maui ransomware campaigns, according to a Kaspersky report.

Source: SC Magazine