From Dream Job to Malware: DreamLoaders in Recent Campaign

Description

An analysis of Lazarus group's DreamJobs campaign reveals sophisticated malware deployment strategies. The group uses various loaders, dubbed 'DreamLoaders', to deploy different payloads. Key components include a trojanized TightVNC client, DLL loaders executed through sideloading, and TSVIPSrv.dll, a loader identified on compromised servers. The campaign aims to extract credentials from targeted organizations' administrators. The malware authenticates to Microsoft tenants, retrieves SharePoint server URLs, and loads encrypted payloads. The modular nature of the loaders allows for flexible payload deployment. The investigation highlights the group's use of legitimate system binaries, encrypted payloads, and stealthy techniques to evade detection.