A “web-based administrative platform to oversee its command-and-control (C2) infrastructure, giving the adversary the ability to centrally supervise all aspects of their campaigns” has been used by the Lazarus Group, a North Korean threat actor.
In a recent report released to The Hacker News, SecurityScorecard’s STRIKE team stated that each C2 server had a web-based management platform that was constructed using a React application and a Node.js API. Even though the attackers used different payloads and obfuscation tactics to avoid detection, this administrative layer remained the same across all of the C2 servers that were examined.
It has been said that the hidden architecture is a hub and a complete system that enables attackers to manage and arrange exfiltrated data read more about Lazarus Group Uses React-Based Admin Panel to Control Global Cyber Attacks.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.